Description
ThinkPHP _method 代码注入漏洞指的是由于 ThinkPHP 框架中的 method 方法可以进行变量覆盖，通过覆盖类的核心属性 filter 攻击者可以调用 Request 类任意方法并构造利用链，从而导致远程代码执行漏洞。该漏洞会导致攻击者可以在服务器上执行任意的攻击代码，窃取服务器上的敏感信息甚至通过系统提权方式控制服务器，危害十分严重。
ThinkPHP _method 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/fofapro/vulfocus/blob/master/writeup/Thinkphp5.0.23%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C/Thinkphp5.0.23%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C.md
https://blog.csdn.net/Nai_zui_jiang/article/details/142032893
https://developer.aliyun.com/article/1260384
https://www.cnblogs.com/--kisaragi--/p/15315131.html
https://blog.nsfocus.net/thinkphp-full-version-rce-vulnerability-analysis/
https://cloud.tencent.com/developer/article/1676328
https://seaii-blog.com/2019/01/14/%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/2019-01-14-ThinkPHP5_%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
https://www.sqyysec.com/ThinkPHP5.X%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
https://kylingit.com/blog/thinkphp-5.0.x-%E7%89%88%E6%9C%AC%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
https://www.exploit-db.com/exploits/46150
https://nvd.nist.gov/vuln/detail/CVE-2018-20062
https://www.tenable.com/blog/thinkphp-remote-code-execution-vulnerability-used-to-deploy-variety-of-malware-cve-2018-20062