CRITICAL: CVE-2018-25270 (CVSS 9.8) — thinkphp thinkphp

CVE: CVE-2018-25270

CVSS: 9.8 (3.1) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: CRITICAL

Status: Critical advisory

Affected

thinkphp thinkphp

Summary

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.

Verified Sources

References

https://github.com/top-think/framework/
https://thinkphp.cn
https://www.exploit-db.com/exploits/45978
https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefunction

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._

Lyrie Verdict

A vulnerability of this severity is exactly what Lyrie's anti-rogue-AI defense is built for: continuous, autonomous monitoring that doesn't wait for human reaction time.

#thinkphp #critical