CVE-2018-20062: NoneCms filter parameter remote PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, KEV listing, and near-maximum EPSS probability makes this an urgent patch-or-isolate case.

What it is

NoneCms V1.3 mishandles the filter parameter in thinkphp/library/think/App.php, letting remote attackers run arbitrary PHP code. The flaw is trivially reachable over HTTP and carries a critical CVSS score of 9.8, so any exposed instance is at serious risk.

Impact

An unauthenticated attacker can execute arbitrary PHP code on the server, leading to full compromise of the application and its host. This can expose data, allow persistence, and enable lateral movement.

Attack surface

Reached over the network via a crafted query string such as s=index/\think\Request/input&filter=phpinfo&data=1. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added it to KEV in November 2021, and EPSS shows a 30-day probability of 0.9953 (99.9th percentile). Public exploit references exist, though no ransomware campaign use is documented.

What to do

• Apply the vendor update for NoneCms/ThinkPHP as instructed by CISA's required action.
• If patching is not immediately possible, remove or restrict public access to the affected application.
• Block or filter requests containing suspicious filter parameters at the WAF or reverse proxy.
• Run the application with least privilege and disable unnecessary PHP functions.
• Monitor for and remove any web shells or unexpected files after suspected exposure.

Detection

• Search web logs for requests containing 'filter=' combined with 'think\Request/input' or similar patterns.
• Alert on outbound connections or process creation from the web server user that are unusual for the application.
• Scan the web root for newly created or modified PHP files that do not match known deployments.
• Review PHP error logs for execution attempts involving the filter parameter.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.