ThinkPHP 3 Arbitrary Code Execution Vulnerability via File Inclusion

A vulnerability allowing remote code execution has been identified in ThinkPHP version 3.2.5. This issue arises from a file inclusion vulnerability in the index.php component, which can be exploited to execute arbitrary code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where ThinkPHP 3.2.5 is running.

Reproduction

To reproduce this vulnerability, send a request to index.php with the 'm', 'c', and 'a' parameters. The 'a' parameter should include a path traversal sequence to access a file with a .html extension that contains PHP code, such as a phpinfo() script. When the request is processed, the included file will be executed, leading to code execution.