CVE-2022-29624
📋 TL;DR
CVE-2022-29624 is an arbitrary file upload vulnerability in TPCMS v3.2 that allows attackers to upload malicious PHP files through the Add File function. This enables remote code execution on affected systems, potentially compromising the entire web server. Organizations using TPCMS v3.2 are at risk.
💻 Affected Systems
- TPCMS
📦 What is this software?
Tpcms by Tpcms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, lateral movement within the network, and persistent backdoor installation.
Likely Case
Webshell deployment allowing attackers to execute commands, steal data, deface websites, and use the server for further attacks.
If Mitigated
Attackers can upload files but cannot execute them due to proper file type validation and execution restrictions.
🎯 Exploit Status
Exploitation requires authentication to access the Add File function, but once authenticated, uploading malicious PHP files is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.3 or later
Vendor Advisory: https://gitee.com/happy_source/tpcms/issues/I533KY
Restart Required: No
Instructions:
1. Backup your TPCMS installation and database. 2. Download the latest version from the official repository. 3. Replace all files with the patched version. 4. Verify the update by checking the version in the admin panel.
🔧 Temporary Workarounds
File Upload Restriction
allImplement server-side validation to block PHP file uploads in the affected directory
# Add to .htaccess in upload directory:
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
Web Application Firewall Rule
allBlock requests containing PHP file uploads to the vulnerable endpoint
🧯 If You Can't Patch
- Disable the Add File functionality completely in TPCMS admin panel
- Implement strict file type validation and store uploaded files outside the web root directory
🔍 How to Verify
Check if Vulnerable:
Check if TPCMS version is 3.2 by examining the admin panel or version files. Test if PHP files can be uploaded via the Add File function.Check Version:
# Check version in TPCMS admin panel or look for version.php fileVerify Fix Applied:
After updating, attempt to upload a PHP file via the Add File function - it should be rejected. Verify version shows 3.3 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to TPCMS upload directory
- PHP file uploads via Add File function
- Multiple failed upload attempts
Network Indicators:
- POST requests to upload endpoints with PHP file content
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/admin/upload" OR uri="/addfile") AND file_extension="php"