Introduction
Threat actors have exploited a critical unauthenticated remote code execution flaw in ThinkPHP 5.0.23 since December 2018, and campaigns using it were still observed as recently as June 2024. CVE-2018-25270 has a CVSS score of 9.8. It lets an attacker execute arbitrary system commands on the server by crafting a malicious HTTP request to the application's index.php endpoint.
ThinkPHP is an open-source PHP web application framework, created in 2006 and released under the Apache2 license. It is very widely used in China, which makes it a significant target for attackers in that region. Shanghai Topthink Information Technology Company develops and maintains the framework and distributes it through GitHub and Packagist.
Technical information
CVE-2018-25270 comes from how ThinkPHP's routing mechanism processes controller names and function invocations. The framework exposes an invokeFunction method that URL routing parameters can reach. When a request arrives at the index.php endpoint, the framework parses the routing parameters to decide which controller and method to invoke. This parsing logic does not properly validate or restrict which functions the routing parameter can call.
An attacker exploits this by building an HTTP request that passes arbitrary PHP function names and their arguments through the URL routing structure. Because the framework does not sanitize the controller name, it treats the attacker-supplied input as a legitimate function invocation. The invokeFunction method then executes the specified PHP function directly on the server.
Attack flow
- The attacker identifies a ThinkPHP 5.0.23 (or earlier) instance exposed to the network, typically by fingerprinting the framework through default responses or error pages.
- The attacker crafts an HTTP request to the
index.phpendpoint. The request includes routing parameters that reference theinvokeFunctionmethod, a dangerous PHP function (such assystemorexec), and the desired command as an argument. - The ThinkPHP routing engine receives the request and processes the controller name incorrectly, without checking whether the target function is restricted.
- The framework invokes the attacker-specified function with the supplied arguments, which executes arbitrary commands on the underlying operating system with the privileges of the web application process.
- The HTTP response returns the command output to the attacker, which confirms that the code executed.
The chain needs no authentication at any point, and the entire attack fits in a single HTTP request.
Overlapping vulnerabilities
ThinkPHP 5.x has multiple overlapping RCE vulnerabilities across different minor versions, all related to controller name processing and routing parameter handling. The invokeFunction vector in version 5.0.23 is one instance of a broader pattern of insufficient input validation in the framework's routing layer.
Affected systems and versions
| Framework Branch | Vulnerable Versions | Fixed Version | Vulnerability Mechanism |
|---|---|---|---|
| ThinkPHP 5.0 | 5.0.23 and earlier | 5.0.24 | Routing parameter invokeFunction RCE |
| ThinkPHP 5.0 | 5.0.22 and earlier | 5.0.23 | Controller name processing |
| ThinkPHP 5.1 | 5.1.29 and earlier | 5.1.30 or later | Controller name processing |
Organizations should check their exact ThinkPHP version number carefully. Because these vulnerabilities overlap across minor versions, a partial upgrade may leave a system exposed to a different but equally critical RCE vector.
Vendor security history
ThinkPHP has a documented history of critical remote code execution vulnerabilities in its 5.x branch. On December 17, 2018, the vendor published a blog post announcing an update that addressed a high-risk RCE vulnerability. Threat actors adopted exploits quickly after that disclosure, which indicates that the vulnerability was straightforward to weaponize. Versions 5.0.22, 5.0.23, and 5.1.29 each had a related RCE flaw with its own fix, which suggests a systemic problem with input validation in the framework's routing and controller subsystems during this period of development.
References
- NVD Entry for CVE-2018-25270
- ThinkPHP Framework GitHub Repository
- ThinkPHP Official Website
- Exploit DB: ThinkPHP 5.0.23/5.1.31 Remote Code Execution
- VulnCheck Advisory: ThinkPHP Remote Code Execution via invokefunction
- Vulhub: ThinkPHP 5.0.23 RCE Environment
- Acunetix: ThinkPHP v5.0.22/5.1.29 Remote Code Execution Vulnerability
- F5 Community: ThinkPHP 5.x Remote Code Execution Vulnerability
- Akamai: Old CVEs, New Targets, Active Exploitation of ThinkPHP
- Qualys: ThinkPHP Remote Code Execution Vulnerability
- NSFOCUS: ThinkPHP Remote Code Execution Vulnerability Handling Guide
