CRITICAL🇵🇱 Wersja polska

CVE-2025-50707

CVSS 9.8v3.1pub. 2025-08-05upd. 2025-08-14

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component

🤖 AI Analysis
How it works

The attacker sends a crafted HTTP request to the index.php component of an application based on ThinkPHP 3.2.5. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and indicates the possibility of code injection and execution on the server side. The exploit requires no authentication, user interaction, or special network conditions, making it trivial to execute remotely.

Impact

Attackers can gain full control of the server — read, modify or delete data, execute arbitrary system commands, and potentially gain access to other resources on the internal network.

Mitigation & patch

Apply patches available from the vendor according to references. Due to lack of active support for the ThinkPHP 3.x branch, urgent migration to a currently supported version of the framework is recommended.

Who is affected

ThinkPHP version 3.2.5 (thinkphp3)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Thinkphp

    APP
    Thinkphp
    3.2.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2018-25270CRITICAL9.3PL ✓same product

ThinkPHP 5.0.23 — zdalne wykonanie kodu przez parametr routingu (RCE)

CVE-2025-63888CRITICAL9.8PL ✓same product

RCE w funkcji read sterownika szablonów ThinkPHP 5.0.24

CVE-2025-50706CRITICAL9.8PL ✓same product

RCE w ThinkPHP 5.1 przez funkcję routecheck

CVE-2024-48112CRITICAL9.8PL ✓same product

ThinkPHP: RCE poprzez deserializację w Index.php (CVE-2024-48112)

CVE-2024-44902CRITICAL9.8PL ✓same product

Krytyczna podatność deserialization RCE w ThinkPHP v6.1.3–v8.0.4