EXPOSURES › CVE-2019-9082
CVE-2019-9082
HIGH ⌖ ON CISA KEV · EXPLOITEDThinkPHP framework suffered a remote code execution vulnerability that was actively exploited in the wild.
ThinkPHP, a widely used PHP framework, contained a remote code execution flaw allowing attackers to execute arbitrary system commands via a specific URL pattern. This failure is critical for DIB organizations because it represents a systemic weakness in the development lifecycle, as evidenced by ThinkPHP's history of similar critical RCE vulnerabilities. Organizations must rigorously assess and remediate their use of ThinkPHP and ensure all components are patched to prevent exploitation.
Shame score — The vulnerability was actively exploited in the wild and ThinkPHP has a documented history of critical RCE flaws, indicating avoidable systemic weaknesses in their development practices.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
"ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command."
"CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks."