PT-2022-19734 · Tpcms · Tpcms

Xrun6 · Published 2022-05-31 · Updated 2022-06-11 · CVE-2022-29624

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TPCMS version 3.2

Description The issue is related to an arbitrary file upload vulnerability in the Add File function, allowing attackers to execute arbitrary code via a crafted PHP file.

Recommendations For TPCMS version 3.2, consider disabling the Add File function until a patch is available to prevent exploitation. Restrict access to the file upload feature to minimize the risk of arbitrary code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-29624

Affected Products

Tpcms

References · 4

• 🔥 https://gitee.com/happy_source/tpcms/issues/I533KY · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29624 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29624 · Vendor Advisory
• https://gitee.com/happy_source/tpcms · Note