ThinkPHP
A popular open-source PHP web development framework in China that has repeatedly exhibited historical RCE and deserialization vulnerabilities.
Timeline (last 90 days)
If Spring Boot is identified, prioritize Actuator endpoints and SpEL injection; if ThinkPHP is identified, focus on historical RCEs and deserialization.
Common signals indicating a target has weak defenses include the use of older versions of CMS or open-source frameworks (such as older versions of ThinkPHP or Shiro), component versions with publicly disclosed CVEs, pages lacking CSRF tokens, or interfaces with no authentication.
All Facts (2)
If Spring Boot is identified, prioritize Actuator endpoints and SpEL injection; if ThinkPHP is identified, focus on historical RCEs and deserialization.
50%UnverifiedCommon signals indicating a target has weak defenses include the use of older versions of CMS or open-source frameworks (such as older versions of ThinkPHP or Shiro), component versions with publicly disclosed CVEs, pages lacking CSRF tokens, or interfaces with no authentication.
50%