lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 29 Mar 2018 19:40:59 +0800
From: "" <>
To: fulldisclosure <>
Subject: [FD] SSRF(Server Side Request Forgery) in Tpshop <= 2.0.6 (CVE-2017-16614)

# SSRF(Server Side Request Forgery) in Tpshop <= 2.0.6 (CVE-2017-16614)

The Tpshop open source mall system is a  multi-merchant mode mall system developed by Shenzhen Leopard Network Co., Ltd.This system is based on the Thinkphp development framework. 

## Product Download:

## Vulnerability Type:SSRF(Server Side Request Forgery)

## Attack Type : Remote

## Vulnerability Description

Tpshop’s former version 2.0.6  is vulnerable to SSRF(Server Side Request Forgery) in the fBill parameter within the "/plugins/payment/weixin/lib/WxPay.tedatac.php?fBil=" path. This vulnerability can lead to arbitrary files reading, network port scanning,information detection, internal network server attack.

The vulnerability code:

    if($_GET['fBill'] && $_GET['WxPayDataBase'])
        header('Content-type: image/jpeg');
        $handle = fopen($_GET['fBill'], 'r');
        fseek($handle , $_GET['WxPayDataBase']);

## Exploit


modify the above fBill parameter,example:

request http protocol: fBill=

request https protocol: fBill=

request ftp protocol: fBill=

file read:fBil=file:///etc/passwd or fBil=file:///c:/windows/win.ini

## Versions

Tpshop <= 2.0.6

## Impact

SSRF(Server Side Request Forgery) in Tpshop before version 2.0.6 allow remote attackers to arbitrary files read,scan network port,information detection,internal network server attack.

## Credit

This vulnerability was discovered by Qian Wu & Bo Wang & Jiawang Zhang &  National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC)

## References


Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ