ThinkPHP Remote Code Execution Vulnerability in NoneCms

A remote code execution vulnerability exists in ThinkPHP versions through 5.0.23, specifically within the NoneCms application version 1.3. The issue arises from improper handling of the filter parameter, which can be exploited by sending a crafted query string. This vulnerability allows attackers to execute arbitrary PHP code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server, executed as the web user.

Reproduction

To reproduce this vulnerability, send a request to the 'index.php' file with the 's' parameter set to a random value. Include the 'filter' parameter with a value that specifies the PHP function to be executed, such as 'phpinfo', and the 'data' parameter with a value of '1'. This will trigger the vulnerability by executing the specified PHP function on the server.