ThinkPHP Framework vulnerable to remote code execution

CRITICAL 9.8CVE-2022-47945 · GHSA-p4qr-vq2g-22wp · Published 23/12/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
topthink/framework Packagist	`< 6.0.14`	`6.0.14`
thinkphp thinkphp	`< 6.0.14`	`6.0.14`

Description

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

NVD description

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

References

nvd.nist.gov/vuln/detail/CVE-2022-47945 · ADVISORY
top-think/framework commit c4acb8b · WEB
top-think/framework · PACKAGE
top-think/framework · WEB
tttang.com/archive/1865 · WEB
tttang.com/archive/1865 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free