CVE-2019-9082: ThinkPHP invokefunction remote code execution
HoneyLabs honeypots recorded 67 probes matching CVE-2019-9082 from 23 distinct source IP addresses in the last 7 days, of which 6 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.
3 sources probed for CVE-2019-9082 on the interactive sensors. None of them sent the exploit payload.
What the sensors show
Probes arrived on every day of the 7-day window. The busiest day was 2026-11-02, with 13. No single address sent more than 12% of them. The largest source network was AS210820 (Enteghal Dadeh Araz Shomal Company PJSC), with 12% of the probes from 1 address. It is still being probed 5 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 1,947 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i170900_5b57614c22b0_78e6aca7449b.
Request paths that identify it
- /?s={{*}}/invokefunction
- /index.php?s={{*}}/invokefunction
- /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=
- /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20thinkphp%20%…
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 85.133.217.136 | 8 | Enteghal Dadeh Araz Shomal Company PJSC | Iran |
| 103.160.205.37 | 6 | PT Akbar Prima Media | Indonesia |
| 103.56.232.39 | 4 | PT Mora Telematika Indonesia | Indonesia |
| 14.34.249.175 | 4 | Korea Telecom | South Korea |
| 165.99.207.153 | 4 | PERN AS Content Servie Provider, Islamabad, Pakistan | Pakistan |
| 177.10.160.46 | 4 | Chapeco Tecnologia em Telecomunicacoes Ltda. | Brazil |
| 184.185.26.51 | 4 | Cox Communications Inc. | United States |
| 196.189.236.67 | 4 | Ethio Telecom | Ethiopia |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS210820 | Enteghal Dadeh Araz Shomal Company PJSC | 8 | 1 |
| AS141595 | PT Akbar Prima Media | 6 | 1 |
| AS4766 | Korea Telecom | 6 | 2 |
| AS131111 | PT Mora Telematika Indonesia | 4 | 1 |
| AS132203 | Tencent Building, Kejizhongyi Avenue | 4 | 2 |
| AS22773 | Cox Communications Inc. | 4 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 13 |
| Indonesia | 10 |
| Iran | 8 |
| Brazil | 6 |
| South Korea | 6 |
| Switzerland | 4 |
Captured requests
- /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello
- /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20thinkphp%20%7C%20rev
- /public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello
Requests the interactive sensors answered
- GET /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello
- GET /public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello
HTTP client fingerprints
- b11cun030_00040012_13ee3d34
- b11cun050_00040035_dd905059
CVE report
Open a specific CVE from the CVE tracker.