NoneCms - RCE (CVE-2018-20062)
Description
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.
psychologyCrowdSec Analysis
CVE-2018-20062 is a critical vulnerability in NoneCms that allows remote attackers to execute arbitrary PHP code through improper input handling in the application logic.
CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2021.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2018-20062 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec network telemetry also shows that exploitation of CVE-2018-20062 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.
Observed exploitation attempts target application endpoints that improperly process user-supplied parameters in backend PHP scripts.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2018-12-11 |
| CISA KEV | 2021-11-03 |
| Rule Released | 2021-12-10 |
| CrowdSec First Seen | 2021-12-10 |
| CISA Remediation Deadline | 2022-05-03 |