Q: Who is affected? (Versions/Components)

🎯 **Affected**: ThinkPHP Framework versions **before 6.0.14**. 📦 **Component**: Core framework logic handling language switching. 📅 **Vendor**: Top Think Information Technology. 🇨🇳

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Threshold**: **Low/Medium**. ✅ **Auth**: Unauthenticated. 📝 **Config**: Requires `lang_switch_on=true` to be enabled in the application config. 🌐 **Network**: Remote exploitation possible. 🚀

Q: How to self-check? (Features/Scanning)

🔍 **Check 1**: Verify ThinkPHP version (< 6.0.14). 📝 **Check 2**: Look for `lang_switch_on=true` in config. 🧪 **Scan**: Use Nuclei template `CVE-2022-47945.yaml`. 🛠️ **Tool**: ProjectDiscovery Nuclei. 📡

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 📦 **Patch**: Upgrade to **ThinkPHP 6.0.14** or later. 🔗 **Commit**: See official GitHub commit `c4acb8b`. 🔄 **Action**: Immediate update recommended. 🛡️

Q: What if no patch? (Workaround)

🚫 **Workaround**: Disable language switching by setting `lang_switch_on=false` in config. 🧱 **Mitigation**: Block external access to `lang` parameter if possible. 🛑 **Note**: Not a permanent fix; patching is superior. ⏳

Q: Is it urgent? (Priority Suggestion)

🚨 **Priority**: **CRITICAL**. 🔴 **Urgency**: High. ⚡ **Reason**: Unauthenticated RCE with public PoC. 🏃 **Action**: Patch immediately to prevent server compromise. 🆘

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: ThinkPHP Framework < 6.0.14 has a **Path Traversal/LFI** flaw.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: The `lang` parameter is not sanitized when **Language Pack Feature** (`lang_switch_on=true`) is enabled.…

Question 3

Who is affected? (Versions/Components)

Accepted Answer

🎯 **Affected**: ThinkPHP Framework versions **before 6.0.14**. 📦 **Component**: Core framework logic handling language switching. 📅 **Vendor**: Top Think Information Technology. 🇨🇳

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

💻 **Privileges**: **Remote Code Execution (RCE)**. 🗑️ **Data**: Full control over the underlying OS.…

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

🔓 **Threshold**: **Low/Medium**. ✅ **Auth**: Unauthenticated. 📝 **Config**: Requires `lang_switch_on=true` to be enabled in the application config. 🌐 **Network**: Remote exploitation possible. 🚀

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🔥 **Exploit**: **Yes**. 📄 **PoC**: Public Nuclei template available on GitHub. 🌍 **Status**: Known technique (using `pearcmd.php`) demonstrated.…

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Check 1**: Verify ThinkPHP version (< 6.0.14). 📝 **Check 2**: Look for `lang_switch_on=true` in config. 🧪 **Scan**: Use Nuclei template `CVE-2022-47945.yaml`. 🛠️ **Tool**: ProjectDiscovery Nuclei. 📡

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed**: Yes. 📦 **Patch**: Upgrade to **ThinkPHP 6.0.14** or later. 🔗 **Commit**: See official GitHub commit `c4acb8b`. 🔄 **Action**: Immediate update recommended. 🛡️

Question 9

What if no patch? (Workaround)

Accepted Answer

🚫 **Workaround**: Disable language switching by setting `lang_switch_on=false` in config. 🧱 **Mitigation**: Block external access to `lang` parameter if possible. 🛑 **Note**: Not a permanent fix; patching is superior. ⏳

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🚨 **Priority**: **CRITICAL**. 🔴 **Urgency**: High. ⚡ **Reason**: Unauthenticated RCE with public PoC. 🏃 **Action**: Patch immediately to prevent server compromise. 🆘

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2022-47945 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring