Actively exploited · Published Feb 24, 2019 · Assigned by mitre
CVE-2019-9082
High 8.8 Exploited
In plain English
A high-severity missing authentication in ThinkPHP from ThinkPHP. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 97.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/xiayulei/open_source_bms/issues/33
- http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html
- 46488 exploit, x_refsource_EXPLOIT-DB, x_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082 government-resource