CVE-2019-9082

Name of the Vulnerable Software and Affected Versions ThinkPHP versions prior to 3.2.4 Open Source BMS version 1.1.1 zzzcms zzzphp

Description A flaw exists in ThinkPHP related to improper handling of code generation when using backslashes ('') as delimiters in the controller name. This can allow a remote attacker to execute arbitrary commands. The issue involves the public//?s=index/thinkapp/invokefunction&function=call user func array&vars[0]=system&vars[1][]= API endpoint, where the vars[1][] parameter is used to inject and execute commands. The call user func array function is involved in the execution process. This issue has been actively exploited.

Recommendations Versions prior to 3.2.4 should be updated to version 3.2.4 or later. For Open Source BMS version 1.1.1, update to a newer, patched version. For zzzcms and zzzphp, update to a newer, patched version.