CVE-2018-20062
ThinkPHP "noneCms" Remote Code Execution Vulnerability
Description
CVE-2018-20062 is a critical-severity remote code execution vulnerability in NoneCms V1.3, which is built on the ThinkPHP framework. The thinkphp/library/think/App.php file allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, enabling complete server compromise without authentication. The vulnerability can be triggered through a specially crafted query string targeting the ThinkPHP request handling mechanism. CISA has added CVE-2018-20062 to its Known Exploited Vulnerabilities catalog, and the EPSS score of 94.3% (99.9th percentile) indicates near-certain active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| 5none | nonecms | 1.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/nangge/noneCms/issues/21(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20062(US Government Resource)
Weakness Type
CVE-2018-20062 does not have a specific CWE classification assigned in the NVD database. However, the vulnerability is a remote code execution flaw stemming from improper input validation in the ThinkPHP framework’s request handling. The filter parameter is passed directly to PHP execution functions without adequate sanitization, allowing attackers to inject and execute arbitrary PHP code on the server.
Impact Analysis
CVE-2018-20062 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating the maximum severity tier. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, making it trivially exploitable by any remote attacker. Confidentiality (High): Arbitrary PHP code execution grants full access to all application data, database contents, configuration files including credentials, and potentially the entire server filesystem. Integrity (High): Attackers can modify application code, inject backdoors, alter database records, and deface websites. Availability (High): Complete service disruption is possible through code execution that terminates processes, corrupts data, or deploys ransomware. With an EPSS score of 94.3% (99.9th percentile), this vulnerability is among the most actively targeted in the entire CVE database, and organizations running NoneCms or ThinkPHP-based applications should treat this as a critical, active threat.
Exploit Maturity
CVE-2018-20062 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for CVE-2018-20062 via Packet Storm Security, and a detailed exploit analysis is documented in the NoneCms GitHub issue tracker. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity, placing this vulnerability among the most exploited across all known CVEs. ThinkPHP-based applications have been widely targeted by automated scanning campaigns and botnet operators seeking to compromise web servers. Federal agencies were required to remediate by 2022-05-03 per CISA’s binding operational directive.
Remediation
- Apply updates immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade NoneCms beyond version 1.3 and update the underlying ThinkPHP framework to a version that addresses the filter parameter code injection vulnerability.
- Deploy a Web Application Firewall (WAF): Configure WAF rules to detect and block requests containing suspicious filter parameter values, particularly those attempting PHP function execution (e.g., phpinfo, system, exec, passthru) in query string parameters.
- Restrict access to the application: Implement IP-based access controls to limit who can reach the web application, and disable any unnecessary public-facing ThinkPHP debug or diagnostic endpoints.
- Audit for prior compromise: Review web server access logs for requests containing the exploit pattern (e.g., “s=index/\think\Request/input&filter=”) to determine if the vulnerability was exploited before patching. Check for unauthorized PHP files, web shells, or modified application code.
- Implement defense-in-depth for PHP applications: Disable dangerous PHP functions (system, exec, passthru, shell_exec, eval) in php.ini where not required, enable open_basedir restrictions, and run the application with least-privilege file system permissions.
Technical Details
CVE-2018-20062 is a remote code execution vulnerability in NoneCms V1.3, specifically in the thinkphp/library/think/App.php file of the underlying ThinkPHP framework. The vulnerability exploits the framework’s request handling mechanism where the filter parameter is used to specify a callback function applied to user input. An attacker can craft a malicious query string such as “s=index/\think\Request/input&filter=phpinfo&data=1” to invoke arbitrary PHP functions with attacker-controlled arguments. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires no privileges or user interaction, and has low complexity. By chaining the ThinkPHP request routing with the filter callback mechanism, an attacker bypasses normal application logic and gains direct access to PHP’s function execution capabilities, enabling execution of system commands, file operations, or any arbitrary PHP code on the server.
Frequently Asked Questions
Is CVE-2018-20062 being actively exploited?
Yes. CVE-2018-20062 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.3% (99.9th percentile) places it among the most exploited vulnerabilities globally. Public exploit code and proof-of-concept demonstrations are readily available.
What products are affected by CVE-2018-20062?
CVE-2018-20062 directly affects NoneCms version 1.3, which is built on the ThinkPHP framework. Any application using a vulnerable version of ThinkPHP (specifically the think/App.php request handling) may also be susceptible to this remote code execution vulnerability.
How do I fix CVE-2018-20062?
Upgrade NoneCms and the underlying ThinkPHP framework to patched versions. Deploy WAF rules to block exploit attempts targeting the filter parameter. Audit your server for signs of prior compromise, and disable dangerous PHP functions in your php.ini configuration.
How severe is CVE-2018-20062?
CVE-2018-20062 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity rating. It allows unauthenticated remote code execution with no user interaction, enabling complete server compromise. The near-certain exploitation probability (EPSS 94.3%) makes immediate remediation essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.