yuan1994/tpadmin · Security
yuan1994 tpAdmin vulnerable to Server-Side Request Forgery
- GHSA ID
- GHSA-qr7h-8pv2-xvx2
- CVE ID
- CVE-2023-1971
- Severity
- medium
- Published
- Updated
- CVSS
- 4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWEs
- CWE-918 · Server-Side Request Forgery (SSRF)