# CVE-2020-20601: ThinkCMF - RCE

> Live exploitation tracking for CVE-2020-20601 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-20601

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** ThinkCMF CMF
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** web_application

## Description

An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.

## CrowdSec analysis

[CVE-2020-20601](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-20601) is a critical vulnerability in ThinkCMF X2.2.2 and earlier that allows remote attackers to execute arbitrary code by sending specially crafted packets. This flaw could be exploited to gain full control over the affected system, leading to data theft, system compromise, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-20601 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2020-20601 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit ThinkCMF by sending requests to `/index.php` with parameters such as `g=g&m=Door&a=index&content=` containing injected PHP code, enabling remote code execution. This pattern targets endpoints where the `content` parameter is processed without proper sanitization.

## Timeline

- 2021-12-22: CVE Published. CVE-2020-20601 is published to NVD.
- 2025-10-29: Rule Released. CrowdSec releases a rule to detect CVE-2020-20601 exploitation attempts against the CrowdSec Network.
- 2025-11-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-20601 for the first time.

## References

- https://blog.riskivy.com/thinkcmf-%e6%a1%86%e6%9e%b6%e4%b8%8a%e7%9a%84%e4%bb%bb%e6%84%8f%e5%86%85%e5%ae%b9%e5%8c%85%e5%90%ab%e6%bc%8f%e6%b4%9e/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-20601.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-20601) follows observed exploitation activity for CVE-2020-20601. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.