ThinkPHP Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| open source background management system | = 1.1.1 | |
| thinkphp | < 3.2.4 | 3.2.4 |
| zzzphp | = 1.6.1 |
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free