ThinkPHP 漏洞列表

Thinkphp3 存在文件包含漏洞，可以读取任意文件内容。

通过组件 vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php 发现 ThinkPHP v6.0.12 包含反序列化漏洞。此漏洞允许攻击者通过精心设计的有效负载执行任意代码。

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php. FOFA: header="think_lang" SHODAN: title:"Thinkphp"

Verbose SQL error message reveals sensitive information including database credentials.

app="ThinkPHP"

fofa app="ThinkPHP"

FOFA: app="ThinkPHP" && title="System Error"

ThinkPHP 2.x version and 3.0 in Lite mode Remote Code Execution.

ThinkPHP是一套开源的、基于PHP的轻量级Web应用开发框架。该漏洞是在受影响的版本中，业务代码中如果模板赋值方法assign的第一个参数可控，则可导致模板文件路径变量被覆盖为携带攻击代码的文件路径，造成任意文件包含，执行任意代码。 蚁剑连接，得到一个webshell，密码为1（日志文件名需改为今天的日期） debug模式关闭：http://x.x.x.x:23707/index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Common/22_04_13.log debug模式开启：http://x.x.x.x:23707/index.php?m=Home&c=Index&a=index&value[_filename]=./Application/Runtime/Logs/Home/22_04_13.log fofa-query: "thinkphp"

Thinkphp5 5.0(<5.0.24) Remote Code Execution.

ThinkPHP 5.0.1 allows remote unauthenticated attackers to execute arbitrary code via the 's' parameter.

ThinkPHP <= 5.0.13

Thinkphp5 5.0.22/5.1.29 Remote Code Execution if the website doesn't have mandatory routing enabled (which is default).

Thinkphp5 5.0(<5.0.24) Remote Code Execution.

A vulnerability in ThinkPHP allows remote unauthenticated attackers to cause the product to execute arbitrary code via the 's' parameter.

TP5-Arbitrary-file-read

thinkphp多语言模块存在Rce漏洞 app="Thinkphp"

thinkphp5-controller-rce

ThinkPHP是中国顶想信息科技公司开发的一款基于PHP的开源轻量级Web应用程序开发框架。ThinkPHP 5.0.24版本由于未正确配置PATHINFO参数，攻击者可以通过访问index.php获取系统环境参数，从而可能导致敏感信息泄露、数据篡改或执行未授权操作。

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.

ThinkPHP 5.0.24 is susceptible to information disclosure. This version was configured without the PATHINFO parameter. This can allow an attacker to access all system environment parameters from index.php, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.