Thinkcmf RCE

The fetch and display functions in the HomeBaseController class(parent class of IndexController) and AdminbaseController class are assigned as public so that they can be accessed easily from outside. A remote attacker can use this vulnerability to construct a malicious URL and write files of arbitrary content to the server without any permission to achieve the purpose of remote code execution.

Affected versions

ThinkCMF X1.6.0,ThinkCMF X2.1.0,ThinkCMF X2.2.0,ThinkCMF X2.2.1,ThinkCMF X2.2.2ThinkCMF X2.2.3

Mitigation / Precaution

• We recommend you to change the modifiers of the display and fetch functions in the HomebaseController.class.php and AdminbaseController.class.php classes to protected.

Written by

Febna V M

Cyber Security Engineer

Febna once spent an entire evening arguing with an AI chatbot just to prove that machines can be confidently wrong. The debate ended with no clear winner, but it did spark her curiosity for the fascinating world of artificial intelligence. Today, she works at the intersection of AI and cybersecurity, helping build smarter systems while making sure they don’t become too smart for their own good. When she’s not exploring the future of technology, she’s probably asking “but what if?” one more time.