NoneCms and ThinkPHP Framework Remote Code Execution (RCE) Vulnerability (CVE-2018-20062)
Executive & SecOps Summary
SECOPS ASSESSMENTNoneCms V1.3 and underlying ThinkPHP 5.x framework-based web applications
Unauthenticated remote attackers can execute arbitrary PHP code and gain full control of the target server by sending crafted HTTP requests
Upgrade the ThinkPHP framework to the latest secure version, apply patches to NoneCms, or deploy Web Application Firewall (WAF) rules
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Update the ThinkPHP framework to the latest secure version. If you are using Composer, run the following command to update the dependency:
# Update ThinkPHP framework via Composer
composer update topthink/framework2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict malicious query patterns at the web server level (e.g., Nginx or Apache) or harden input filtering in config/app.php.
# Nginx configuration rule to block suspicious ThinkPHP RCE patterns
server {
listen 80;
server_name localhost;
if ($query_string ~* "filter=(system|phpinfo|eval|assert|passthru|shell_exec)") {
return 403;
}
if ($query_string ~* "think\\Request") {
return 403;
}
}3. Log Audit & IoC Verification Commands
Use the following command to scan web server access logs for potential exploitation attempts targeting the ThinkPHP framework.
# Scan Apache/Nginx access logs for ThinkPHP RCE exploit attempts
grep -Ei 'think\\Request|filter=' /var/log/nginx/access.log /var/log/httpd/access_log 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical Remote Code Execution (RCE) flaw arising from insufficient input validation in NoneCms V1.3 and the ThinkPHP framework. A structural defect in think/App.php allows user-supplied parameters to be dynamically invoked without proper sanitization during controller processing. Specifically, the filter parameter can be manipulated to specify arbitrary PHP callback functions, leading to unvalidated execution by the PHP engine.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts an HTTP GET or POST request, manipulating the routing path via the s parameter and specifying a target PHP function (e.g., phpinfo, system, assert) in the filter parameter. For instance, sending a query string like s=index/ hink\Request/input&filter=phpinfo&data=1 triggers ThinkPHP's internal reflection mechanism to call the input method of the think\Request class, executing the specified phpinfo function. Since no authentication is required, remote attackers can easily exploit this flaw.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, with an EPSS score exceeding 0.99. Successful exploitation allows attackers to execute arbitrary system commands under the privileges of the web server process. This can lead to sensitive database exposure, deployment of persistent web shells, ransomware deployment, and lateral movement within the internal network.
Official Vendor Advisories & References
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.
Frequently Asked SecOps Questions (CVE-2018-20062)
FAQQ1. How critical is CVE-2018-20062 and is it actively exploited in the wild?
CVE-2018-20062 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-20062?
Primary impacted vendors include nonecms, topthink across nonecms, thinkphp. Scope summary: NoneCms V1.3 and web applications running on ThinkPHP 5.0.x (up to and including 5.0.23)
Q3. What temporary mitigations or workarounds exist for CVE-2018-20062 before patching?
[Mitigation] Upgrade the ThinkPHP framework to the latest secure version, apply patches to NoneCms, or deploy Web Application Firewall (WAF) rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-20062
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (nonecms)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.