{"id":"CVE-2018-20062","kind":"vulnerability","aliases":["CVE-2018-20062"],"related":[],"title":"ThinkPHP noneCms: ThinkPHP \"noneCms\" Remote Code Execution Vulnerability","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input&filter=phpinfo&data=1 query string.","summary":"noneCms V1.3 bundles a ThinkPHP library whose App.php lets remote attackers run arbitrary PHP code through a crafted filter parameter in the query string. An attacker who can reach the site gets code execution on the web server.","severity":"critical","cvss":9.8,"epss":0.9953,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"ThinkPHP noneCms","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"noneCms","fixed":[],"affected":"1.3.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","nonecms","php","poc-public","runtime","self-hosted","thinkphp"],"not_affected_if":["managed-hosting","not-nonecms"],"how_to_check":"Look for noneCms V1.3 (cpe 5none:nonecms:1.3.0) and read the version constant in thinkphp/base.php (THINK_VERSION) on the server. Check web logs for requests containing 'think\\Request/input', 'invokefunction' or 'filter=' with phpinfo/system. Only test with a phpinfo probe on systems you own.","fix":"No patched noneCms release is documented. Upstream ThinkPHP fixed this class of bug in 5.0.24 (and 5.1.x later), per a third-party nuclei template and Tenable's 2018-12-09 patch date; not verified on a ThinkPHP primary page. Update the bundled thinkphp/ directory to a current ThinkPHP 5.0.x/5.1.x release, or stop using noneCms. Until then, block requests with s=index/\\think\\Request/input, invokefunction or filter[] at the WAF, and don't expose the site publicly.","status":"open","published_at":"2018-12-11T18:29:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:34+00:00","updated_at":"2026-10-23T21:01:09+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T20:29:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown\nunknown","summary":"noneCms V1.3 bundles a ThinkPHP library whose App.php lets remote attackers run arbitrary PHP code through a crafted filter parameter in the query string. An attacker who can reach the site gets code execution on the web server.","category":"runtime","who_cares":["php","noneCms","self-hosted","thinkphp"],"confidence":0.8,"analyst_note":"Sources do not name a patched noneCms or ThinkPHP version; check the NVD and CISA KEV pages for vendor guidance and whether a fixed release exists.","how_to_check":"Search the deployed web root for thinkphp/library/think/App.php and check whether the site runs noneCms V1.3.\nSend a request with the query string s=index/\\think\\Request/input&filter=phpinfo&data=1 to a noneCms endpoint and see whether phpinfo output appears (only on systems you own).\nunknown","needs_analyst":true,"not_affected_if":["not-noneCms","managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.0004,"input_tokens":2136,"output_tokens":372,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not name a patched noneCms or ThinkPHP version; check the NVD and CISA KEV pages for vendor guidance and whether a fixed release exists.","search":"'-20062':11A,14A '-2018':10A,13A '1':101C 'allow':75C 'app.php':36B 'arbitrari':41B,80C 'attack':39B,54B,77C 'bundl':31B 'code':6A,43B,61B,82C 'craft':46B,84C 'cve':9A,12A 'data':100C 'demonstr':91C 'discov':70C 'execut':7A,62B,79C 'exploit':18B 'filter':47B,88C,98C 'get':60B 'host':27B 'index':95C 'issu':68C 'let':37B 'librari':34B 'nonecm':2A,4A,19B,29B,72C 'nonecms':16A,17A 'paramet':48B,89C 'php':20B,42B,81C 'phpinfo':99C 'poc':22B 'poc-publ':21B 'public':23B 'queri':51B,102C 'reach':57B 'remot':5A,38B,76C 'request/input':97C 'run':40B 'runtim':24B 'self':26B 'self-host':25B 'server':66B 'site':59B 'string':52B,103C 'think':96C 'thinkphp':1A,3A,15A,28B,33B 'thinkphp/library/think/app.php':74C 'use':85C 'v1.3':30B,73C 'via':83C 'vulner':8A 'web':65B 'whose':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-12-11T18:29:00+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2018-20062","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-20062","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2018-20062","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-20062","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-20062","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20062","severity":null,"published_at":"2018-12-11T18:29:00+00:00","modified_at":"2026-06-17T01:52:14+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2018-20062:35","url":null,"severity":null,"published_at":"2026-10-23T21:01:09+00:00","modified_at":"2026-10-23T21:01:09+00:00","first_seen_at":"2026-10-23T21:01:09+00:00","fetched_at":"2026-10-23T21:01:09+00:00","note":"NVD/CISA KEV: NoneCms 1.3 bundled ThinkPHP RCE, KEV since 2021-11-03, public PoCs, mass exploitation by IoT botnets (Tenable). No noneCms vendor fix found; the issue page could not be read. Nuclei template says ThinkPHP 5.0.24+, not confirmed on a primary page."}],"documents":[{"id":889,"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20062","title":"NVD CVE-2018-20062","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":890,"url":"https://www.tenable.com/blog/thinkphp-remote-code-execution-vulnerability-used-to-deploy-variety-of-malware-cve-2018-20062","title":"Tenable: ThinkPHP RCE used to deploy malware","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":891,"url":"https://github.com/vulhub/vulhub/tree/master/thinkphp/5-rce","title":"Vulhub ThinkPHP5 RCE","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":892,"url":"https://github.com/nangge/noneCms/issues/21","title":"noneCms issue 21","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}