Skip to content

Access Control: ThinkPHP 5.0.1 - Remote Code Execution

Identifier: thinkphp_501_rce

Scanner Support

GraphQL Scanner REST Scanner WebApp Scanner ASM Scanner Automated Pentest

Description

ThinkPHP 5.0.1 allows remote unauthenticated attackers to execute arbitrary code via the 's' parameter.

How we test: We test for remote code execution vulnerabilities in ThinkPHP by injecting malicious payloads into the 's' parameter and analyzing responses to detect if arbitrary code is executed.

Reference:

Configuration

Example

Example configuration:

---
security_tests:
  thinkphp_501_rce:
    skip: false

Reference

skip

Type: boolean

Skip the test if true.