Shulou(Shulou.com)05/31 Report--

In this issue, Xiaobian will bring you about how to understand Thinkphp 5.1.37 -5.1.41(the latest version) deserialization vulnerability recurrence. The article is rich in content and analyzed and described from a professional perspective. After reading this article, I hope you can gain something.

0x01 Introduction

Record the process of learning and understanding the anti-sequence vulnerability of thinkphp

0x02 Impact Version

5.1.37-5.1.41(Latest version)

0x03 Environment construction

1. composer create-project topthink/think=5.1.37 v5.1.37 (5.1.37-5.1.41 are available)

2、github：

https://github.com/top-think/think/releases

https://github.com/top-think/framework/releases

0x04 Bug recurrence

First add a deserialized entry

deserialize the input parameter in application\index\controller\index.php

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.