QID 13517

ThinkPHP is an extremely widely used PHP development framework in China. In its version 5.0(prior to v5.0.24), while obtaining the request method, the framework processes it incorrectly, which allows an attacker to call any method of the Request class, resulting in a RCE vulnerability through a specific exploit chain.

Affected Versions:
ThinkPHP 5.x prior to v5.0.24

QID Detection Logic:
This QID checks for vulnerable installation of ThinkPHP by sending a crafted payload to the 'index.php?s=captcha' endpoint as an HTTP POST request. The payload tries to execute commands such as 'cat /etc/passwd' , 'id' etc to check for code execution.

Successful exploitation of the vulnerability may allow a remote unauthenticated attacker to execute arbitrary code, leading to critical data loss or complete system compromise.