Actively exploited in the wild
ThinkPHP Remote Code Execution Vulnerability
ThinkPHP - ThinkPHP · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-9082
HighCVSS 8.8KEVSummary
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the server, potentially leading to full system compromise.
Recommendation
Upgrade ThinkPHP to version 3.2.4 or later, which includes the fix.
Other vulnerabilities in ThinkPHP
See all- CVE-2025-63888Critical
The read function in thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
- CVE-2024-44902Critical
A deserialization vulnerability in ThinkPHP versions 6.1.3 through 8.0.4 allows attackers to execute arbitrary code remotely. The issue stems from unsafe processing of input data during deserialization.
Original NVD description (English source)
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.