A critical remote code execution vulnerability in the tpadmin system allows unauthenticated attackers to gain full control over the affected web server.

The vulnerability resides in the preview.php file within the WebUploader library. It enables unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution with the privileges of the web server.

Successful exploitation of this vulnerability results in full system compromise, allowing attackers to execute arbitrary commands, exfiltrate sensitive data, or deploy malicious payloads. Given the CVSS score of 7.3 and the nature of remote code execution, the business impact is severe, posing a direct threat to data integrity, confidentiality, and overall service availability.

Immediate Action: As there is no official patch available, administrators should immediately remove or restrict access to the vulnerable /public/static/admin/lib/webuploader/0.1.5/server/preview.php file.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests directed at the WebUploader component, specifically looking for base64 encoded payloads or attempts to upload .php files.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to block requests to the vulnerable path and filter out malicious content types or suspicious file upload attempts.

Public Exploit Available: Yes, a public proof of concept is available via GitHub, as documented in the provided research writeup.

This vulnerability is highly critical due to the ease of exploitation and the resulting impact of total system takeover. Because the affected software is no longer supported by the maintainer, users must take immediate manual action to disable the vulnerable component or migrate to a more secure alternative to mitigate the threat of remote exploitation.