{"id":"CVE-2019-9082","title":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app","published":"2019-02-24T14:29:00.207Z","updated":"2026-06-16T22:43:02.110Z","severity":"high","cvssScore":8.8,"epss":0.97419,"epssPct":0.999,"kev":true,"maturity":"weaponized","actionScore":94,"primaryVendor":"thinkphp","primaryProduct":"thinkphp","cweId":"CWE-94","fixAvailable":false,"tags":["pre-auth","rce","remote"],"epssDelta7":0,"summary":"ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssVersion":"3.1","cvssSource":"nvd-primary","cweName":"Improper Control of Generation of Code ('Code Injection')","kevAdded":"2021-11-03T00:00:00.000Z","kevDue":"2022-05-03T00:00:00.000Z","kevRansomware":"Unknown","source":"nvd","cna":"mitre","ssvc":{"exploitation":"active","automatable":"no","impact":"total"},"sources":{"adp":"2025-12-09T14:38:34.117Z","cna":"2025-12-09T14:38:34.117Z","epss":"2026-11-11","nuclei":"2026-11-13T03:18:10.620Z","cna_seen":"2026-09-29T10:54:15.444Z","exploitdb":"2026-11-13T03:17:58.683Z","metasploit":"2026-11-13T03:18:09.107Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":2,"metasploit":1,"nuclei":1,"githubPoc":0},"products":[{"vendor":"thinkphp","product":"thinkphp","cpe":"cpe:2.3:a:thinkphp:thinkphp"},{"vendor":"opensourcebms","product":"open source background management system","cpe":"cpe:2.3:a:opensourcebms:open_source_background_management_system"},{"vendor":"zzzcms","product":"zzzphp","cpe":"cpe:2.3:a:zzzcms:zzzphp"}],"references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9082","tags":"US Government Resource"}],"exploits":[{"source":"exploitdb","kind":"remote","date":"2020-04-16"},{"source":"exploitdb","kind":"webapps","date":"2019-03-04"},{"source":"metasploit","kind":"exploit","date":"2018-12-10"},{"source":"nuclei","kind":"high","date":null}],"analysis":null,"affectedVersions":[{"vendor":"opensourcebms","product":"open source background management system","version":"1.1.1","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"thinkphp","product":"thinkphp","version":"*","vsi":null,"vse":null,"vei":null,"vee":"3.2.4"},{"vendor":"zzzcms","product":"zzzphp","version":"1.6.1","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}