Hackers Ramp Up Attacks on Outdated ThinkPHP and ownCloud Flaws

Hackers are increasingly targeting unpatched systems vulnerable to older security flaws, specifically CVE-2022-47945 in ThinkPHP and CVE-2023-49103 in ownCloud.

The ThinkPHP flaw is a local file inclusion (LFI) vulnerability that allows unauthenticated attackers to execute arbitrary OS commands when the language pack feature is enabled. Meanwhile, the ownCloud vulnerability stems from a third-party library exposing PHP environment details, enabling attackers to steal sensitive information from unpatched systems. Despite patches being available for years, many devices remain vulnerable, with GreyNoise detecting 572 unique IPs exploiting the ThinkPHP flaw and 484 targeting the ownCloud weakness.

CVE-2023-49103 was even ranked among the top 15 most exploited vulnerabilities of 2023 by the FBI, CISA, and NSA. Security experts recommend updating to ThinkPHP 6.0.14 and ownCloud GraphAPI 0.3.1, while also taking unpatched instances offline or placing them behind firewalls.

This surge in attacks highlights the critical need for timely patching to defend against cyber threats exploiting outdated software vulnerabilities.