CVE-2018-20062

5none nonecms

Published 11 Dec 2018 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.

References

packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
github.com/nangge/noneCms/issues/21 · Exploit, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20062 · US Government Resource