CVE-2022-30060
📋 TL;DR
FTCMS version 2.1 and earlier contains an arbitrary file write vulnerability in admin/controllers/tp.php that allows authenticated attackers to write arbitrary files to the server. This affects all FTCMS installations running vulnerable versions, particularly those with admin panel access exposed.
💻 Affected Systems
- FTCMS
📦 What is this software?
Ftcms by Ftcms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through web shell deployment leading to data theft, ransomware deployment, or server takeover.
Likely Case
Unauthorized file modification leading to website defacement, data manipulation, or backdoor installation.
If Mitigated
Limited impact with proper file permission restrictions and admin panel isolation.
🎯 Exploit Status
Exploitation requires admin authentication; public proof-of-concept exists in Chinese documentation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to latest FTCMS version if available, or implement workarounds.
🔧 Temporary Workarounds
Remove vulnerable file
linuxDelete or rename the vulnerable tp.php file to prevent exploitation
rm admin/controllers/tp.php
mv admin/controllers/tp.php admin/controllers/tp.php.bak
Restrict file permissions
linuxSet strict permissions on admin directory to prevent unauthorized access
chmod 750 admin/
chmod 640 admin/controllers/tp.php
🧯 If You Can't Patch
- Implement strict access controls on admin panel with strong authentication
- Deploy web application firewall rules to block file write attempts to tp.php
🔍 How to Verify
Check if Vulnerable:
Check if file exists at admin/controllers/tp.php and verify FTCMS version <= 2.1Check Version:
Check FTCMS version in configuration files or admin panelVerify Fix Applied:
Confirm tp.php file is removed/renamed or permissions are restricted📡 Detection & Monitoring
Log Indicators:
- POST requests to admin/controllers/tp.php with file write parameters
- Unauthorized file creation/modification in web directories
Network Indicators:
- HTTP requests to tp.php endpoint with file manipulation parameters
SIEM Query:
web.url.path:"admin/controllers/tp.php" AND http.method:POST