thinkphp3.2.3 rce漏洞复现

根据引用中提供的信息，ThinkPHP3.2.x存在一个RCE（远程代码执行）漏洞。根据引用中的描述，我们可以通过控制`$this->img`变量来找到`destroy()`函数。在`ThinkPHP/Library/Think/Session/Driver/Memcache.class.php`文件中的`Memcache`类的`destroy()`函数中可以找到这个函数。请注意，如果使用PHP7，在调用有参函数但没有传入参数的情况下会报错，因此应该使用PHP5而不是PHP7。具体的漏洞利用方法是，在URL中注入`?id=1*/ into outfile "path/1.php" LINES STARTING BY '<?php eval($_POST<span class="em">1</span><span class="em">2</span><span class="em">3</span>
#### 引用[.reference_title]
- *1* [wp 篇 DASCTF Thinkphp 3.2.3RCE复现](https://blog.csdn.net/weixin_46203060/article/details/119532553)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v92^chatsearchT3_1"}}] [.reference_item style="max-width: 50%"]
- *2* *3* [【安全漏洞】ThinkPHP 3.2.3 漏洞复现](https://blog.csdn.net/2201_75857869/article/details/129316463)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v92^chatsearchT3_1"}}] [.reference_item style="max-width: 50%"]
[ .reference_list ]