| शीर्षक | tpAdmin RCE |
|---|
| विवरण | tpadmin is a ThinkPHP5.0 official version and Hui.admin v2.5 management background, simplify the management of the background development process, simplify the preparation of code, improve code reuse rate, while integrating complete permissions management and other commonly used functions in the management background
An arbitrary file upload vulnerability exists in tpadmin, allowing an attacker to take over server privileges.
The file upload function in this controller does not set the file format filter, so that the webshell can be uploaded.
Vulnerability point:
application\admin\controller\Upload.php
upload() function
$file parameter
The program does not filter the file upload function, which leads to security risks, such as an attacker may upload a webshell.
|
|---|
| स्रोत | ⚠️ https://tib36.github.io/2023/04/09/tpAdmin-RCE/ |
|---|
| उपयोगकर्ता | nokali (UID 42250) |
|---|
| सबमिशन | 09/04/2023 10:59 AM (4 साल पहले) |
|---|
| संयम | 10/04/2023 05:49 PM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 225407 [yuan1994 tpAdmin 1.3.12 Upload.php Upload file अधिकार वृद्धि] |
|---|
| अंक | 15 |
|---|