Thinkphp · Thinkphp · CVE-2019-9082
**Name of the Vulnerable Software and Affected Versions**
ThinkPHP versions prior to 3.2.4
Open Source BMS version 1.1.1
zzzcms
zzzphp
**Description**
A flaw exists in ThinkPHP related to improper handling of code generation when using backslashes ('') as delimiters in the controller name. This can allow a remote attacker to execute arbitrary commands. The issue involves the `public//?s=index/thinkapp/invokefunction&function=call user func array&vars[0]=system&vars[1][]=` API endpoint, where the `vars[1][]` parameter is used to inject and execute commands. The `call user func array` function is involved in the execution process. This issue has been actively exploited.
**Recommendations**
Versions prior to 3.2.4 should be updated to version 3.2.4 or later.
For Open Source BMS version 1.1.1, update to a newer, patched version.
For zzzcms and zzzphp, update to a newer, patched version.