CVE-2019-9082

What is ThinkPHP?

ThinkPHP is a popular open-source PHP web application framework widely used across Chinese-language web development and adopted globally for building content-management and business web applications.

Overview

CVE-2019-9082 is a critical remote code execution vulnerability (CVSS 8.8) in ThinkPHP that allows an unauthenticated attacker to execute arbitrary code by abusing the framework's dynamic method-invocation feature. Since its public disclosure, it has become one of the most widely and continuously mass-exploited web application vulnerabilities, scanned for and weaponized by countless botnets.

Technical Details

ThinkPHP's routing and controller-dispatch logic can be manipulated through crafted URL parameters (e.g., ?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=<command>) to invoke arbitrary PHP functions such as call_user_func_array, effectively letting an attacker call functions like system() with attacker-controlled arguments — achieving remote code execution with a single unauthenticated HTTP request (CWE-94, code injection).

Discovery

This vulnerability class in ThinkPHP was widely discussed in Chinese-language security research communities following its disclosure in early 2019, with proof-of-concept payloads circulating publicly almost immediately.

Exploitation Context

ThinkPHP RCE payloads of this type have been mass-exploited by internet-wide scanning botnets for years, used to deploy cryptocurrency miners, DDoS bots (including Mirai and Gafgyt variants), and self-propagating worms. CISA added this CVE to KEV in November 2021, and the vulnerability continues to appear in honeypot and IDS telemetry as one of the most frequently attempted exploits against exposed PHP applications.

Remediation

1. Upgrade ThinkPHP to a patched release (5.0.24/5.1.32 or later, depending on branch) that disables unsafe dynamic method invocation.
2. Disable debug mode and dynamic controller/method invocation in production configurations if not required.
3. Deploy a web application firewall to block known ThinkPHP exploitation URL patterns.
4. Audit web server and application logs for the characteristic invokefunction/call_user_func_array request pattern.
5. Isolate and rebuild any host found running an unpatched, internet-exposed ThinkPHP instance, given the high likelihood of prior mass-scanning compromise.