PT-2022-17318 · Unknown · Thinkphp Framework

Published 2022-03-20 · Updated 2025-09-03 · CVE-2022-25481

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ThinkPHP Framework version 5.0.24

Description The ThinkPHP Framework was discovered to be configured without the PATHINFO parameter, allowing attackers to access all system environment parameters from index.php. It is noted that this issue is disputed by a third party, as system environment exposure is an intended feature of the debugging mode.

Recommendations For ThinkPHP Framework version 5.0.24, consider configuring the PATHINFO parameter to prevent unauthorized access to system environment parameters. As a temporary workaround, consider disabling the debugging mode until a proper configuration can be implemented.

Exploit

Fix

Improper Access Control

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-284

CWE-668

Related Identifiers

CVE-2022-25481

GHSA-69WP-XWM7-69WM

Affected Products

Thinkphp Framework

References · 8

• 🔥 https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25481 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25481 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-69wp-xwm7-69wm · Vendor Advisory
• https://github.com/top-think/framework · Note
• https://t.me/cvenotify/77736 · Telegram Post
• https://t.me/cvenotify/88692 · Telegram Post
• https://t.me/cyberok_news/136 · Telegram Post