VYPR
← All advisories
Moderate severityNVD Advisory· Published May 4, 2024· Updated Aug 16, 2024

CVE-2024-34467

CVE-2024-34467

Description

ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ThinkPHP 8.0.3 allows reflected XSS in debug error page due to insufficient filtering of function argument values in think_exception.tpl.

CVE-2024-34467 describes a reflected Cross-Site Scripting (XSS) vulnerability in ThinkPHP 8.0.3. The issue originates in the think_exception.tpl template file, where function argument values are not properly filtered before being included in the error page output [1]. This allows an attacker to inject arbitrary JavaScript code via crafted input parameters.

Exploitation does not require authentication, as the vulnerable endpoint is accessible to any remote user. The attacker can craft a URL containing a malicious payload in the query string, which gets reflected in the debug error page when the application encounters an exception [1]. The provided PoC demonstrates a request like /?=1 which triggers the XSS. The vulnerability specifically affects the debug mode error handling; if debug mode is enabled, an attacker can execute scripts in the context of the victim's browser.

Successful exploitation can lead to theft of session cookies, even if the HttpOnly flag is set, as the debug page exposes cookie values in the error message [1]. An attacker could potentially perform actions on behalf of the victim, such as session hijacking or data theft. The impact is heightened when the application is in debug mode, which is common during development but may be inadvertently left enabled in production.

A fix has been implemented in commit 403358cd3e510e2fdab63f951930bdd093314eee, which addresses the encoding of the $key variable to prevent XSS [2]. Users are advised to update to a patched version or disable debug mode in production environments. The vulnerability is actively discussed and details are available in the GitHub issue [1]. It is important to note that the vulnerability affects the latest version (8.0.3) and potentially earlier versions as well [1].

References
  1. Reflected XSS(Cross Site Scripting)
  2. 修正 $key 未编码 · top-think/framework@403358c

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
topthink/frameworkPackagist
>= 8.0.0, < 8.0.48.0.4
topthink/frameworkPackagist
>= 6.1.0, < 6.1.56.1.5
topthink/frameworkPackagist
< 6.0.176.0.17

Affected products

2

Patches

3
d3904e51e279

Merge pull request #3001 from big-dream/6.0-issues-2996

https://github.com/top-think/frameworkjwjApr 16, 2024via ghsa
commit
1 file changed · +1 −1
  • src/tpl/think_exception.tpl+1 −1 modified
    @@ -68,7 +68,7 @@ if (!function_exists('parse_args')) {
                     break;
             }
 
-            $result[] = is_int($key) ? $value : "'{$key}' => {$value}";
+            $result[] = is_int($key) ? $value : sprintf('\'%s\' => %s', htmlentities($key), $value);
         }
 
         return implode(', ', $result);
57d1950a1844

Merge pull request #3000 from big-dream/6.1-issues-2996

https://github.com/top-think/frameworkjwjApr 16, 2024via ghsa
commit
1 file changed · +1 −1
  • src/tpl/think_exception.tpl+1 −1 modified
    @@ -68,7 +68,7 @@ if (!function_exists('parse_args')) {
                     break;
             }
 
-            $result[] = is_int($key) ? $value : "'{$key}' => {$value}";
+            $result[] = is_int($key) ? $value : sprintf('\'%s\' => %s', htmlentities($key), $value);
         }
 
         return implode(', ', $result);
403358cd3e51

修正 $key 未编码

https://github.com/top-think/frameworkjwjApr 9, 2024via ghsa
commit
1 file changed · +1 −1
  • src/tpl/think_exception.tpl+1 −1 modified
    @@ -68,7 +68,7 @@ if (!function_exists('parse_args')) {
                     break;
             }
 
-            $result[] = is_int($key) ? $value : "'{$key}' => {$value}";
+            $result[] = is_int($key) ? $value : sprintf('\'%s\' => %s', htmlentities($key), $value);
         }
 
         return implode(', ', $result);

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.