p PatchFirst

CVE-2023-1971

CVE-2023-1971 · yuan1994 tpAdmin Upload.php remote server-side request forgery

This page contains facts from public vulnerability sources. Check the original advisory before updating.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 6.3 · Medium · EPSS 0.6%

Published
Updated

Stack: php

Affected products and versions

  • tpadmin

    Versions
    • 1.3.12: Affected

    No fix published

  • yuan1994/tpadmin Packagist

    Versions
    • v1.1
    • v1.2
    • v1.2.1
    • v1.2.2
    • v1.3
    • v1.3.1
    • v1.3.10
    • v1.3.11
    • v1.3.12
    • v1.3.2
    • v1.3.3
    • v1.3.4
    • v1.3.5
    • v1.3.6
    • v1.3.7
    • v1.3.8
    • v1.3.9
    Affected ranges
    • ECOSYSTEM: ≤ 1.3.12

    No fix published

Original sources

Check your server →