GHSA-p4qr-vq2g-22wp

ThinkPHP Framework vulnerable to remote code execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-47945

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	topthink/framework	< 6.0.14	6.0.14

Details

As written in the advisory (Markdown source, shown as plain text).

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (`lang_switch_on=true`). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including `pearcmd.php`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-47945 advisory
https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099 web
https://github.com/top-think/framework package
https://github.com/top-think/framework/compare/v6.0.13...v6.0.14 web
https://tttang.com/archive/1865 web