CVE-2022-25481 Exposure of Resource to Wrong Sphere in ThinkPHP Framework
Attackers can access system environment parameters via index.php when PATHINFO is missing, exposing sensitive configuration data in ThinkPHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25481?
CVE-2022-25481 is a medium-severity vulnerability in n/a, published on 20 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
Which versions are affected by CVE-2022-25481?
2 open source packages ship an affected version, including topthink/framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
topthink/framework Packagist | All versions to 5.0.24 | None |
topthink/framework Packagist | All versions to 5.0.24 | None |
Products include Thinkphp Thinkphp.
How do I fix CVE-2022-25481?
No fix has been published for CVE-2022-25481 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-25481 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-25481 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
Sources
Also known as GHSA-69wp-xwm7-69wm.