{"id":"CVE-2019-9082","aliases":["EUVD-2019-18467","GHSA-qpgr-mp84-gp92"],"status":"published","title":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote...","description":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.97419,"percentile":0.99899,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-306","CWE-94"],"published":"2019-02-24T18:00:00Z","modified":"2026-10-24T10:50:36Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/unix/webapp/thinkphp_rce","title":"ThinkPHP Multiple PHP Injection RCEs","type":"exploit","platform":"Linux,Unix","date":"2018-12-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/webapp/thinkphp_rce"},{"source":"exploitdb","id":"EDB-46488","title":"zzzphp CMS 1.6.1 - Cross-Site Request Forgery","type":"webapps","platform":"php","date":"2019-03-04","url":"https://www.exploit-db.com/exploits/46488"},{"source":"exploitdb","id":"EDB-48333","title":"ThinkPHP - Multiple PHP Injection RCEs (Metasploit)","type":"remote","platform":"linux","date":"2020-04-16","verified":true,"url":"https://www.exploit-db.com/exploits/48333"},{"source":"nuclei","id":"CVE-2019-9082","title":"ThinkPHP \u003c 3.2.4 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9082.yaml"}],"products":[{"vendor":"opensourcebms","product":"open_source_background_management_system"},{"vendor":"thinkphp","product":"thinkphp"},{"vendor":"zzzcms","product":"zzzphp"}],"references":[{"url":"https://github.com/xiayulei/open_source_bms/issues/33","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.exploit-db.com/exploits/46488/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9082"},{"url":"https://www.exploit-db.com/exploits/46488"},{"url":"http://packetstormsecurity.com/files/151967/zzzphp-CMS-1.6.1-Cross-Site-Request-Forgery.html"},{"url":"https://github.com/advisories/GHSA-qpgr-mp84-gp92"}],"sources":{"cve":[{"id":"CVE-2019-9082","description":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","status":"published","published":"2019-02-24T18:00:00Z","modified":"2025-12-09T14:38:34.117Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-18467","description":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","status":"published","published":"2019-02-24T18:00:00Z","modified":"2025-12-09T14:38:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T19:49:08.541096Z"}],"ghsa":[{"id":"GHSA-qpgr-mp84-gp92","title":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote...","description":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","status":"published","published":"2022-05-13T01:02:54Z","modified":"2025-12-08T18:31:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-306"],"updated_at":"2026-11-02T15:05:05.469565Z"}],"kev":[{"id":"CVE-2019-9082","title":"ThinkPHP Remote Code Execution Vulnerability","description":"ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","cwes":["CWE-306","CWE-94"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2019-9082","description":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","status":"published","published":"2019-02-24T18:29:00.207Z","modified":"2026-06-17T02:43:02.11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94","CWE-306"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-9082","description":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=system\u0026vars[1][]= followed by the command.","status":"published","published":"2019-02-24T18:29:00.207Z","modified":"2026-10-24T10:50:36.565610121Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"}]}}