Remote Code Execution Vulnerability in ThinkAdmin Software

CVE-2024-10749

Summary

A serious security vulnerability has been identified in ThinkAdmin software versions up to 6.1.67, specifically within the function script located in /app/admin/controller/api/Plugs.php. This vulnerability arises from improper handling of the 'uptoken' argument, leading to the possibility of deserialization attacks. Attackers can exploit this flaw remotely, although the complexity of executing such an attack is relatively high, making it difficult for less sophisticated actors. Public disclosure of this exploit means that proactive measures should be taken by administrators to safeguard their systems. Despite early notifications sent to the vendor regarding this issue, no responses have been received, further emphasizing the need for users to be vigilant and responsive in addressing this vulnerability to protect against potential exploitation.

References