{"id":"CVE-2018-20062","aliases":["EUVD-2018-12637","GHSA-gf7c-4w4p-7cm5"],"status":"published","title":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers...","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input\u0026filter=phpinfo\u0026data=1 query string.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.9953,"percentile":0.99946,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-20"],"published":"2018-12-11T18:00:00Z","modified":"2026-10-20T10:49:54Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/unix/webapp/thinkphp_rce","title":"ThinkPHP Multiple PHP Injection RCEs","type":"exploit","platform":"Linux,Unix","date":"2018-12-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/unix/webapp/thinkphp_rce"},{"source":"pocgithub","id":"NS-Sp4ce/thinkphp5.XRce","title":"NS-Sp4ce/thinkphp5.XRce","date":"2019-03-17","url":"https://github.com/NS-Sp4ce/thinkphp5.XRce"},{"source":"exploitdb","id":"EDB-48333","title":"ThinkPHP - Multiple PHP Injection RCEs (Metasploit)","type":"remote","platform":"linux","date":"2020-04-16","verified":true,"url":"https://www.exploit-db.com/exploits/48333"},{"source":"pocgithub","id":"0xRar/ThinkPHP5_RCE","title":"0xRar/ThinkPHP5_RCE","date":"2022-10-18","url":"https://github.com/0xRar/ThinkPHP5_RCE"},{"source":"pocgithub","id":"yilin1203/CVE-2018-20062","title":"yilin1203/CVE-2018-20062","date":"2022-11-07","url":"https://github.com/yilin1203/CVE-2018-20062"},{"source":"pocgithub","id":"shenhui35/RedArrow","title":"shenhui35/RedArrow","date":"2025-09-16","url":"https://github.com/shenhui35/RedArrow"},{"source":"pocgithub","id":"Jasper2018/CVE-2018-20062","title":"Jasper2018/CVE-2018-20062","date":"2026-09-10","url":"https://github.com/Jasper2018/CVE-2018-20062"},{"source":"nuclei","id":"CVE-2018-20062","title":"ThinkPHP 5.0.23 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-20062.yaml"}],"products":[{"vendor":"5none","product":"nonecms"},{"vendor":"thinkphp","product":"nonecms"}],"references":[{"url":"https://github.com/nangge/noneCms/issues/21","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/157218/ThinkPHP-5.0.23-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20062","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20062"},{"url":"https://github.com/advisories/GHSA-gf7c-4w4p-7cm5"}],"sources":{"cve":[{"id":"CVE-2018-20062","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input\u0026filter=phpinfo\u0026data=1 query string.","status":"published","published":"2018-12-11T18:00:00Z","modified":"2025-10-21T23:45:46.278Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:35:00.237825Z"}],"euvd":[{"id":"EUVD-2018-12637","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input\u0026filter=phpinfo\u0026data=1 query string.","status":"published","published":"2018-12-11T18:00:00Z","modified":"2025-10-21T23:45:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-gf7c-4w4p-7cm5","title":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers...","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input\u0026filter=phpinfo\u0026data=1 query string.","status":"published","published":"2022-05-13T01:27:19Z","modified":"2025-10-22T00:31:37Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2018-20062","title":"ThinkPHP \"noneCms\" Remote Code Execution Vulnerability","description":"ThinkPHP \"noneCms\" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.","cwes":["CWE-20"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2018-20062","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input\u0026filter=phpinfo\u0026data=1 query string.","status":"published","published":"2018-12-11T18:29:00.197Z","modified":"2026-06-17T01:52:14.323Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:04:49.995593Z"}],"osv":[{"id":"CVE-2018-20062","description":"An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input\u0026filter=phpinfo\u0026data=1 query string.","status":"published","published":"2018-12-11T18:29:00.197Z","modified":"2026-10-20T10:49:54.612750176Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.145458Z"}]}}