ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
References
| Link | Resource |
|---|---|
| https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md | Exploit Third Party Advisory |
Configurations
History
03 Jul 2024, 01:38
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 |
23 Apr 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode. |
29 Mar 2022, 01:43
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CWE | CWE-668 | |
| References | (MISC) https://github.com/Lyther/VulnDiscover/blob/master/Web/ThinkPHP_InfoLeak.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:thinkphp:thinkphp:5.0.24:*:*:*:*:*:*:* |
21 Mar 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-21 00:15
Updated : 2024-08-03 05:16
NVD link : CVE-2022-25481
Mitre link : CVE-2022-25481
CVE.ORG link : CVE-2022-25481
JSON object : View
Products Affected
thinkphp
- thinkphp