CVE-2019-9082: ThinkPHP Remote Code Execution Vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2021-11-03
EPSS: 97.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-02-24 · updated 2026-06-17
Weakness: CWE-94

Description

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

Affected products

Opensourcebms Open Source Background Management System: 1.1.1
ThinkPHP: before 3.2.4 — fixed in 3.2.4
Zzzcms Zzzphp: 1.6.1

How to fix

Upgrade to a fixed version: ThinkPHP 3.2.4. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html
https://github.com/xiayulei/open_source_bms/issues/33
http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html
https://github.com/xiayulei/open_source_bms/issues/33
https://www.exploit-db.com/exploits/46488/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082

Get alerted when CVE-2019-9082 or the next vulnerability affects your stack