GitHub Advisoryadvisory · Packagist

GHSA-4vp2-mj4m-69m4 ThinkAdmin insecure unserialize vulnerability

CRITICAL Published 2022-05-24 Modified 2025-05-15 Official page ↗
Aliases
CVE-2020-23653
Ecosystem
Packagist
Packages
zoujingli/thinkadmin
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-04-24

Affected packages

• Packagist zoujingli/thinkadmin: >= 4.0, < 6.1.0 → fixed in 6.1.0

Description

An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in `app/admin/controller/api/Update.php `and `app/wechat/controller/api/Push.php`, which may lead to arbitrary remote code execution.

Related

Alias · CVE (1)

  • CVE-2020-23653 An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References