CVE-2023-1970: yuan1994 tpAdmin Unrestricted Upload of File with Dangerous Type vulnerability
Summary
CVE-2023-1970: yuan1994 tpAdmin Unrestricted Upload of File with Dangerous Type vulnerability. Affects yuan1994/tpadmin versions < 1.3.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
yuan1994 tpAdmin is a package available on Packagist that provides functionality for managing administrative tasks in a web application. It includes features such as file uploading. This vulnerability affects version 1.3.12 of the package. The maintainer no longer supports this version.
Vulnerability Detail
The Upload function in the file application\admin\controller\Upload.php of yuan1994 tpAdmin 1.3.12 is vulnerable to an unrestricted upload of files with dangerous types. This allows an attacker to upload malicious files to the server. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed. The associated identifier for this vulnerability is VDB-225407. The Common Weakness Enumeration (CWE) ID for this vulnerability is CWE-434. The vulnerability has a CVSSv3 score of 7.2, indicating a high severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix provided by the package maintainer.
Conclusion
The yuan1994 tpAdmin package version 1.3.12 is vulnerable to an unrestricted upload of files with dangerous types. This can lead to various security risks and compromise the server. It is crucial to upgrade to a supported version of the package or apply the fix provided by the maintainer. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yuan1994/tpadmin →
FAQ
This vulnerability allows an attacker to upload malicious files to the server, which can lead to various consequences such as remote code execution, data breaches, or server compromise.
Yes, the exploit for this vulnerability has been publicly disclosed and may be used by attackers.
This vulnerability affects version 1.3.12 of yuan1994 tpAdmin. Other versions may also be affected if they are no longer supported by the maintainer.
A fix for this vulnerability is not currently available. It is recommended to upgrade to a supported version of the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for yuan1994/tpadmin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
