PT-2025-31940 · Thinkphp3 · Thinkphp3

Xinyisleep · Publicado 2025-08-05 · Atualizado 2025-08-05 · CVE-2025-50707

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thinkphp3 version 3.2.5

Description An issue in thinkphp3 allows a remote attacker to execute arbitrary code via the index.php component. This can be achieved through crafted template inclusion, requiring no login.

Recommendations Block public access to index.php. Add Web Application Firewall (WAF) rules.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2025-50707

Produtos afetados

Thinkphp3

Referências · 8

• 🔥 https://xinyisleep.github.io/2024-07-15/Thinkphp3.%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%AB-CNVD-2024-39045 · Exploit
• https://t.me/CVEtracker/29212 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50707 · Nota
• https://twitter.com/VolerionSec/status/1952751549186294062 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-50707 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-50707 · Nota de Segurança
• https://twitter.com/CVEnew/status/1952758221166285263 · Publicação no Twitter
• https://xinyisleep.github.io/CVE-2025-50707.md · Nota