exploit-thinkphp

name	exploit-thinkphp
description	ThinkPHP 5.x RCE exploit via invokefunction route (CVE-2018-20062). Targets PHP applications built on ThinkPHP 5.0/5.1 framework. Use after fingerprinting confirms ThinkPHP presence.
metadata	{"openclaw":{"emoji":"💥","requires":{"bins":["python3","curl"],"env":[]},"primaryEnv":null}}

exploit-thinkphp

Exploits the ThinkPHP 5.x invokefunction route to achieve unauthenticated remote code execution (CVE-2018-20062).

Target Framework

ThinkPHP 5.0.x and 5.1.x — common in Chinese enterprise web applications.

Usage

Provide target (base URL of the ThinkPHP application) and optional params.cmd (shell command to run). The skill constructs the exploit URL, sends the request, and returns command output.

Parameters

Param	Type	Required	Description
target	string	yes	Base URL of the ThinkPHP application
cmd	string	no	OS command to execute (default: id)
timeout	int	no	Timeout in seconds (default: 30)

Notes

Works on unpatched ThinkPHP 5.0.x ≤ 5.0.23 and 5.1.x ≤ 5.1.30. Verify with ehole/whatweb fingerprint before use.