CVE-2018-6029

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL validation only considers whether the URL contains the "csdn" substring.
SSRF
Severity
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Atk. Vector
NETWORK
Atk. Complexity
LOW
Priv. Required
NONE
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
VendorProductVersion
5nonenonecms
1.3.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://blackwolfsec.cc/2018/01/23/Nonecms_ssrf/
http://blackwolfsec.cc/2018/01/23/Nonecms_ssrf/