CVE-2019-9082
ThinkPHP Remote Code Execution Vulnerability
Description
CVE-2019-9082 is a high-severity code injection vulnerability affecting ThinkPHP, a popular PHP framework. ThinkPHP before version 3.2.4 fails to properly sanitize user input passed through URL parameters, allowing attackers to execute arbitrary system commands on the server via the invokefunction endpoint. This vulnerability is classified under both code injection (CWE-94) and missing authentication for critical function (CWE-306), as the dangerous functionality is exposed without any authentication requirement. CISA has confirmed active exploitation of this vulnerability in the wild by adding it to the Known Exploited Vulnerabilities catalog. With an EPSS score of 94.26% (99.93rd percentile), CVE-2019-9082 is among the most actively exploited vulnerabilities tracked.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| thinkphp | thinkphp | < 3.2.4 |
| opensourcebms | open source background management system | 1.1.1 |
| zzzcms | zzzphp | 1.6.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/xiayulei/open_source_bms/issues/33(Exploit, Issue Tracking, Third Party Advisory)
- https://www.exploit-db.com/exploits/46488/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (‘Code Injection’)
Code injection occurs when an application constructs code segments using externally-influenced input without properly neutralizing special elements. In ThinkPHP, the invokefunction endpoint allows attackers to call arbitrary PHP functions with user-controlled arguments, effectively granting code execution through the framework’s routing mechanism.
Learn more: CWE-94 — Improper Control of Generation of Code (‘Code Injection’)
CWE-306: Missing Authentication for Critical Function
Missing authentication for critical function occurs when software exposes privileged operations without requiring any user identity verification. In the case of ThinkPHP, the invokefunction endpoint that enables arbitrary function calls is publicly accessible without authentication, meaning any remote attacker can directly invoke system commands.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2019-9082 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting a severe threat to affected systems. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though some form of user interaction is needed according to the CVSS metrics. Successful exploitation results in high impact across all three security dimensions: Confidentiality (High) allows attackers to read sensitive data including configuration files, credentials, and database contents; Integrity (High) enables modification of application code, data, and system files; and Availability (High) permits attackers to disrupt services or deploy ransomware. With an EPSS score of 94.26%, this vulnerability is near-certain to be actively exploited, and organizations running unpatched ThinkPHP instances face immediate risk of complete system compromise.
Exploit Maturity
CVE-2019-9082 has a well-established exploit landscape with multiple public proof-of-concept exploits available. Public exploit code is available via Packet Storm Security and Exploit-DB, significantly lowering the barrier to exploitation. CISA has confirmed active exploitation in the wild by listing this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 94.26% (99.93rd percentile) indicates near-certain exploitation activity, placing this among the most exploited vulnerabilities currently tracked. The simplicity of the attack — requiring only a crafted URL — makes it particularly accessible to automated scanning tools and botnets.
Remediation
- Apply vendor patches immediately as required by CISA KEV. Upgrade ThinkPHP to version 3.2.4 or later, which addresses the remote code execution vulnerability in the invokefunction routing mechanism.
- Verify that all deployments using ThinkPHP-based applications are updated, including Open Source BMS v1.1.1 and zzzphp v1.6.1 which bundle the vulnerable ThinkPHP framework.
- If immediate patching is not possible, block access to the vulnerable endpoint by configuring your web application firewall (WAF) or reverse proxy to deny requests containing the
/invokefunctionpath pattern andcall_user_func_arrayparameters. - Review web server access logs for indicators of exploitation attempts, specifically looking for requests matching the pattern
/?s=index/\think\app/invokefunction&function=call_user_func_array, and investigate any systems where such requests were successful. - Implement defense-in-depth measures by ensuring ThinkPHP applications never expose code execution functions to user-controllable input and enforce authentication on all administrative and internal endpoints.
Technical Details
CVE-2019-9082 exploits a flaw in ThinkPHP’s URL routing mechanism that allows direct invocation of internal framework functions via crafted HTTP requests. The attack targets the /public/?s=index/\think\app/invokefunction endpoint, passing call_user_func_array as the function parameter and a system command as the argument, effectively achieving remote code execution through PHP’s native function invocation. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the attack is network-based with low complexity and requires no privileges, though user interaction is flagged. The vulnerability combines two fundamental weaknesses: code injection (CWE-94) through the ability to invoke arbitrary functions, and missing authentication (CWE-306) as the dangerous endpoint is exposed without any access control. ThinkPHP versions prior to 3.2.4 failed to restrict which functions could be called through the routing mechanism, turning a framework feature into a critical remote code execution vector.
Frequently Asked Questions
Is CVE-2019-9082 being actively exploited?
Yes. CVE-2019-9082 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.26% (99.93rd percentile) indicates near-certain exploitation activity, and multiple public exploits are readily available.
What products are affected by CVE-2019-9082?
CVE-2019-9082 affects ThinkPHP versions prior to 3.2.4. Additionally, products that bundle or rely on the vulnerable ThinkPHP framework are affected, including Open Source Background Management System (BMS) version 1.1.1 and zzzphp version 1.6.1.
How do I fix CVE-2019-9082?
Upgrade ThinkPHP to version 3.2.4 or later. For applications bundling ThinkPHP, check with the vendor for updated releases. As an interim measure, block access to the invokefunction endpoint using WAF rules or web server configuration.
How severe is CVE-2019-9082?
CVE-2019-9082 has a CVSS 3.1 score of 8.8 (HIGH), indicating a serious vulnerability that enables remote code execution. With an EPSS score in the 99.93rd percentile, it is among the most likely vulnerabilities to be exploited, demanding immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.