ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Link | Tags |
---|---|
https://github.com/xiayulei/open_source_bms/issues/33 | issue tracking exploit third party advisory |
https://www.exploit-db.com/exploits/46488/ | exploit vdb entry third party advisory |
http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html | exploit vdb entry third party advisory |