CVE-2019-6713

Name of the Vulnerable Software and Affected Versions ThinkCMF version 5.0.190111

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using specific vectors involving the portal/List/index and list/:id endpoints to inject code into the data/conf/route.php file. For example, this can be demonstrated by a file put contents call.

Recommendations For ThinkCMF version 5.0.190111, consider restricting access to the portal/List/index and list/:id endpoints until a patch is available. As a temporary workaround, avoid using the file put contents function in the RouteController.php file to prevent code injection.