{"id":"CVE-2018-25270","published":"2026-04-22T14:57:03Z","modified":"2026-04-22T15:59:29Z","title":"ThinkPHP 5.0.23 Remote Code Execution via invokefunction","vendor":"Thinkphp","product":"ThinkPHP","tier":"core","eol":null,"affectedVersions":[{"vendor":"Thinkphp","product":"ThinkPHP","versions":["5.0.23","5.1.31"]}],"description":{"text":"ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.","provenance":"source","from":"CVE.org"},"summary":{"text":"ThinkPHP 5.0.23 contains a remote code execution flaw in its routing handling of the invokefunction parameter, affecting the ThinkPHP product's index.php endpoint. An unauthenticated attacker with network access to that endpoint can craft a request with malicious function parameters to run arbitrary PHP code and system commands with the application's privileges, requiring no authentication, user interaction, or special configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:59Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0089,"percentile":0.59341,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-06-04","exploitedFirstSeen":"2026-06-04","ransomware":false,"evidence":[{"url":"https://www.stormshield.com/news/current-cyberattack-trends-variations-honeypots/","date":"2026-06-04"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"Known_Cve | May 1, 2026","url":"https://otx.alienvault.com/pulse/69f378c160039674e6d8b0e2","created":"2026-04-30"},{"name":"Known_Cve | Apr 30, 2026","url":"https://otx.alienvault.com/pulse/69f22775c0cab1a8490f77d4","created":"2026-04-29"},{"name":"Known_Cve | Apr 29, 2026","url":"https://otx.alienvault.com/pulse/69f0d6daf049026984c0056a","created":"2026-04-28"},{"name":"Known_Cve | Apr 28, 2026","url":"https://otx.alienvault.com/pulse/69ef8579b85b581c4f7eec39","created":"2026-04-27"},{"name":"Known_Cve | Apr 27, 2026","url":"https://otx.alienvault.com/pulse/69ee331bb594352d6f03f42f","created":"2026-04-26"},{"name":"Known_Cve | Apr 26, 2026","url":"https://otx.alienvault.com/pulse/69ece1c766d687ee21cf62ab","created":"2026-04-25"},{"name":"Known_Cve | Apr 25, 2026","url":"https://otx.alienvault.com/pulse/69eb90c7628bfe372d1727ed","created":"2026-04-24"}],"provenance":"machine"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"references":[{"url":"https://www.exploit-db.com/exploits/45978","tags":["exploit"]},{"url":"https://thinkphp.cn","tags":["product"]},{"url":"https://github.com/top-think/framework/","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefunction","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-21786","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-21786","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.exploit-db.com/exploits/45978"],"flow":[],"timeline":[{"date":"2026-04-22","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-25270","provenance":"source"},{"date":"2026-06-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.stormshield.com/news/current-cyberattack-trends-variations-honeypots/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":65.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 149 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.87,"detail":"percentile 0.5934"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}