ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

The version of ThinkPhP installed on the remote host is prior to 5.0.24. It is, therefore, affected by a remote code execution vulnerability. An unauthenticated, remote attacker can exploit this to execute arbitrary php code through multiple parameters.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ThinkPHP hosted on the remote web server allows an unauthenticated, remote attacker to execute arbitrary php code through multiple parameters.

ID	Name	Product	Family	Severity
155964	ThinkPHP < 5.0.24 RCE	Nessus	Web Servers	high
121621	ThinkPHP Multiple Parameter RCE	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-9082

high

Tenable Plugins

high

critical