CVE-2018-25270

The vulnerability results from insufficient validation of routing parameters in the index.php endpoint. An unauthenticated attacker can craft an HTTP request containing malicious function parameters, which are then passed to the framework's function invocation mechanism (invokeFunction). In this way, the attacker can invoke any PHP function, including system functions that enable shell command execution with the privileges of the web application process.

An unauthenticated attacker can execute arbitrary system commands on the server with application privileges, which may lead to complete server takeover, data theft, or installation of malicious software.

Apply patches available from the vendor according to the references. It is recommended to immediately update the ThinkPHP framework to a version higher than 5.0.23 and restrict access to the index.php endpoint at the firewall level in case immediate update deployment is not possible.

ThinkPHP version 5.0.23