ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
References
| Link | Resource |
|---|---|
| https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md | Exploit Third Party Advisory |
Configurations
History
23 Apr 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode. |
29 Mar 2022, 01:43
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (MISC) https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md - Exploit, Third Party Advisory | |
| First Time |
Thinkphp
Thinkphp thinkphp |
|
| CWE | CWE-668 | |
| CPE | cpe:2.3:a:thinkphp:thinkphp:5.0.24:*:*:*:*:*:*:* |
21 Mar 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-21 00:15
Updated : 2024-04-23 08:15
NVD link : CVE-2022-25481
Mitre link : CVE-2022-25481
CVE.ORG link : CVE-2022-25481
JSON object : View
Products Affected
thinkphp
- thinkphp
CWE
CWE-668
Exposure of Resource to Wrong Sphere