CVE-2018-25270 - Vulnerability Analysis

Overview

ThinkPHP 5.0.23 contains a remote code execution caused by invoking functions through the routing parameter, letting unauthenticated attackers execute arbitrary PHP code with application privileges, exploit requires crafted requests to index.php.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary PHP code, potentially leading to full system compromise.

Mitigation

Update to the latest version.

References

• https://github.com/top-think/framework/
• https://thinkphp.cn
• https://www.exploit-db.com/exploits/45978
• https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefunction

Social Media Activity(1 post)

Yazoul - Cybersecurity Alerts

@Matchbook3469

Apr 23, 2026

⛔ New security advisory: CVE-2018-25270 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • Risk: Attackers can gain full control of affected systems • Mitigation: Patch immediately or isolate affected systems Full breakdown: https://www.yazoul.net/advisory/cve/cve-2018-25270-thinkphp-5-0-23-unauthenticated-remote-code-execution #Cybersecurity #VulnerabilityManagement #CyberSec

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner