CVE-2019-9082

CVE-2019-9082 is an unauthenticated remote code execution flaw (CWE-94 code injection, CWE-306 missing authentication) in ThinkPHP versions before 3.2.4, as shipped in Open Source BMS v1.1.1 and other ThinkPHP-based products. An attacker triggers it by sending a crafted HTTP GET request to the route public/?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=<command>, which makes the framework invoke the system function with attacker-controlled arguments. Because no authentication is required, any remote attacker who can reach the web application can execute arbitrary operating-system commands with the privileges of the web server, typically gaining a foothold for data theft, ransomware, or botnet/cryptomining implants. Affected users are operators of ThinkPHP-based sites and applications, specifically ThinkPHP prior to 3.2.4, Open Source BMS v1.1.1, and ZzzCMS zzzphp as listed by CISA. Exploitation is confirmed in the wild: the flaw is in CISA KEV (added 2021-11-03), has a 97.4% EPSS probability of exploitation within 30 days, and threat-actor activity against old ThinkPHP flaws — including a Chinese threat actor since October 2023 and the DirtyMoe wormable botnet — keeps pressure on unpatched servers.

What to do: Upgrade ThinkPHP to version 3.2.4 or later (or a currently supported maintained branch) and update Open Source BMS beyond v1.1.1 and zzzphp to vendor-patched releases, per CISA's required action. Check access logs for requests to the invokefunction route (public/?s=index/\think\app/invokefunction with call_user_func_array/system) and hunt for signs of follow-on webshell, botnet, or cryptomining activity, given active abuse by Chinese-linked actors and the DirtyMoe botnet. As interim mitigation, block or restrict the invokefunction route at a WAF/reverse proxy for unauthenticated users; remediation is mandatory under BOD 22-01 because the flaw is in KEV.