CVE-2018-25270·PHP vulnerability

Affected versions

How to fix this CVE

Upgrade PHP to version 5.0.24 or later to patch the remote code execution vulnerability in the routing parameter handler. This critical vulnerability allows unauthenticated attackers to execute arbitrary PHP code through specially crafted requests to index.php. Immediately apply the patch and restart your PHP application to mitigate exploitation risk.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /index\.php.*(?:function|invoke|call)\s*=|index\.php\?.*(?:system|exec|shell_exec|passthru|proc_open)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block requests to index.php containing function invocation parameters such as 'function=', 'invoke=', or 'call=' in the query string or POST body. Restrict routing parameter values to whitelisted function names only and reject requests with suspicious PHP function names (system, exec, shell_exec, eval, etc.).

How to check if you are affected

1. Run `php -v` to verify the installed PHP version and confirm if it is 5.0.23 or earlier
2. Check if PHP routing through index.php is enabled by reviewing your web server configuration (nginx/Apache) and PHP application bootstrap files
3. Search web server logs for POST/GET requests containing suspicious function invocations via routing parameters, such as requests with `?function=system` or similar patterns
4. After applying the patch, re-run `php -v` to confirm the version is 5.0.24 or later, and verify the application restarts without errors

FAQ

Related PHP CVEs

References

• https://github.com/top-think/framework/
• https://thinkphp.cn
• https://www.exploit-db.com/exploits/45978
• https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefunction