CVE-2022-47945: Path Traversal
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (langswitchon=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Other sources
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (langswitchon=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-47945?
CVE-2022-47945 is a vulnerability in the ThinkPHP Framework before version 6.0.14 that allows for local file inclusion and arbitrary command execution.
How severe is CVE-2022-47945?
CVE-2022-47945 has a severity rating of 9.8 (critical).
How does CVE-2022-47945 work?
CVE-2022-47945 can be exploited by an unauthenticated remote attacker by using the lang parameter with the language pack feature enabled, allowing them to execute arbitrary operating system commands.
Which software versions are affected by CVE-2022-47945?
ThinkPHP Framework versions before 6.0.14 are affected by CVE-2022-47945.
How can CVE-2022-47945 be fixed?
To fix CVE-2022-47945, it is recommended to update to ThinkPHP Framework version 6.0.14 or higher.