VulnerabilityAnalyzed

CVE-2019-9082

ThinkPHP Remote Code Execution Vulnerability

KEVEXPLOIT ×2 ✓HIGH 8.8EPSS 97.4%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 97.42% probability · 100th percentile
Public exploits: 2 in Exploit-DB · verified · first 4 March 2019
CISA KEV: Listed 3 November 2021 · due 3 May 2022
Weakness: CWE-94, CWE-306
Affected: thinkphp/thinkphp · opensourcebms/open source background management system · zzzcms/zzzphp
Source: cve@mitre.org

EPSS trend

EPSS 97.4% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-9082

Public exploits (2)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-48333 source ↗	ThinkPHP - Multiple PHP Injection RCEs (Metasploit)linux · Metasploit	remote	16 April 2020	yes
EDB-46488 source ↗	zzzphp CMS 1.6.1 - Cross-Site Request Forgeryphp · Yang Chenglong	webapps	4 March 2019	no

References

http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/xiayulei/open_source_bms/issues/33Exploit, Issue Tracking, Third Party Advisory
http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/xiayulei/open_source_bms/issues/33Exploit, Issue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/46488/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.