High severity · published Jan 23, 2018
CVE-2018-6029
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server…
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL validation only considers whether the URL contains the "csdn" substring.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Nonecms · 5none
1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6029
Exploit
http://blackwolfsec.cc/2018/01/23/Nonecms_ssrf/
More from Nonecms
9.8
CVE-2018-20062
ThinkPHP "noneCms" Remote Code Execution Vulnerability
8.8
CVE-2018-7219
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html…
7.5
CVE-2020-18647
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/nonecms/vendor"
7.5
CVE-2020-18646
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php"
6.5
CVE-2019-16721
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user