CVE-2019-9082

ThinkPHP before 3.2.4 has a flaw that lets attackers run arbitrary commands on the server by crafting a special URL. This happens because the framework doesn't properly restrict which functions can be called, allowing an attacker to execute system commands without permission.

Remote Command Execution via improper function invocation restriction in ThinkPHP's public interface. Attackers can bypass access controls by manipulating URL parameters to invoke call_user_func_array with arbitrary system commands. No authentication required; successful exploitation grants full code execution with application privileges.