TPshop - Local File Inclusion

What is "TPshop - Local File Inclusion?"

The "TPshop - Local File Inclusion" module is designed to detect a vulnerability in the TPshop software that allows for local file inclusion. TPshop is a targeted software that may have misconfigurations or vulnerabilities. This module specifically focuses on the vulnerability of local file inclusion.

This module has a severity level of high, indicating that it poses a significant risk to the security of the TPshop software.

Impact

A local file inclusion vulnerability in TPshop can allow an attacker to include arbitrary files from the server's file system. This can lead to unauthorized access to sensitive information, such as configuration files, user credentials, or even system files. Exploiting this vulnerability can potentially result in a complete compromise of the affected system.

How the module works?

The "TPshop - Local File Inclusion" module works by sending a specific HTTP request to the target server. The request path includes a parameter that allows the attacker to traverse directories and access files outside the intended scope. The module then checks the response for specific patterns to determine if the vulnerability is present.

For example, the module may send a GET request to /index.php/Home/uploadify/fileList?type=.+&path=../../../. This request attempts to access files outside the expected directory structure.

The module uses matching conditions to validate the vulnerability. It checks if the response contains the phrase "state":"SUCCESS" and if the HTTP status code is 200. If both conditions are met, the module reports the vulnerability.

For more information about this module, please refer to the original author's documentation.