CVE-2022-25481 PoC — ThinkPHP 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25481.yaml

Associated Vulnerability

Title:ThinkPHP 安全漏洞 (CVE-2022-25481)
Description:顶想信息科技 ThinkPHP是中国顶想信息科技公司的一套基于PHP的、开源的、轻量级Web应用程序开发框架。 ThinkPHP Framework v5.0.24 存在安全漏洞，该漏洞源于没有配置 PATHINFO 参数。攻击者可以从 index.php 访问所有系统环境参数。

Description

ThinkPHP 5.0.24 is susceptible to information disclosure. This version was configured without the PATHINFO parameter. This can allow an attacker to access all system environment parameters from index.php, thereby possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.

File Snapshot


 id: CVE-2022-25481

info:
  name: ThinkPHP 5.0.24 - Information Disclosure
  author: caon
  severity

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!