CVE-2022-47945

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
thinkphpthinkphp
𝑥
< 6.0.14
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099
https://github.com/top-think/framework/compare/v6.0.13...v6.0.14
https://tttang.com/archive/1865/
https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099
https://github.com/top-think/framework/compare/v6.0.13...v6.0.14
https://tttang.com/archive/1865/