终极一班3ThinkPHP 5.x漏洞自查清单：你的后台还裸奔吗_我的网站
A | 一键部署OpenClaw ThinkPHP是国内站长的老朋友，也是老漏洞的重灾区。
B | 5.x早期版本暴露过多次高危问题，比如远程代码执行、控制器任意调用。
C | Rob Reiner and Michele Singer Reiner's two other children, Jake and Romy have issued first statement about their parents' deaths. While they opened up about the devastating circumstances, they did not openly speak about their brother Nick Reiner's involvement in the homicides. "Words cannot even begin to describe the unimaginable pain we are experiencing every moment of the day. The horrific and devastating loss of our parents, Rob and Michele Reiner, is something that no one should ever experience. They weren't just our parents; they were our best friends,” the siblings said in a statement. They added, "We are grateful for the outpouring of condolences, kindness, and support we have received not only from family and friends but people from all walks of life. We now ask for respect and privacy, for speculation to be tempered with compassion and humanity, and for our parents to be remembered for the incredible lives they lived and the love they gave." The statement was issued on the same day their brother, Nick Reiner, appeared in court for the first time on Wednesday. In the court hearing, they waived his right to enter a plea on two counts of first-degree murder. For those unaware, Nick has been charged with two counts of first-degree murder. He is being held without bail, since the time he has been taken into custody. The Los Angeles Police Department has also claimed that Nick Reiner is responsible for his parents' deaths. About Rob and Michele Singer Reiner's deathsRob Reiner and Michele Singer Reiner were discovered dead at their Los Angeles residence. The county medical examiner confirmed that the couple were victims of a homicide. They sustained multiple sharp-force wounds. Authorities have so far declined to share details about the evidence, any suspected motive, or the circumstances that led to Nick Reiner’s arrest.Also Read: Nick Reiner Charged With Murder in Deaths of Parents Rob Reiner and Michele Singer Reiner。
D | 最坑的是很多站上线后没再更新过框架，漏洞一直躺在那儿。
自查第二步是限制后台入口。把admin、manage这些路径用Nginx做IP白名单或者加HTTP基本认证，别让搜索引擎随便扫到。同时关闭debug模式，runtime目录禁止执行脚本。 # Nginx中禁止访问敏感路径 location ~* ^/(application|extend|runtime|thinkphp|vendor)/ { deny all; } # 禁止执行上传目录里的PHP location ~* ^/upload/.*\.(php|php5|phtml)$ { deny all; } 最后一条容易被忽略：不要用默认的应用名和入口。
E | 很多扫描器直接请求/index.php/admin/login或者/index.php?s=/admin，你把后台入口改名，就能挡住一大半批量攻击。 数据来源：ThinkPHP官方安全公告及topthink/framework GitHub仓库版本更新记录 申请创业报道，分享创业好点子。点击此处，共同探讨创业新机遇！。 Current article:http://px0jlc.senchuoshaozaodidia.shop/kvhyzh/hn2s6.html Published on:15:21:03 |
自查第一步是确认版本。ThinkPHP 5.0.x/5.1.x低于特定小版本就要升级。先把composer.lock或者框架目录里的base.php版本号翻出来，再对照官方安全公告。 # 快速查看当前ThinkPHP版本 grep -r "VERSION" vendor/topthink/framework/src/think/App.php # 或者看composer.lock grep -A1 '"name": "topthink/framework"' composer.lock 