WordPress Plugin Database Backup < 5.2 - Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WP Database Backup RCE', 'Description' = %q There exists a command injection vulnerability in the Wordpress plugin wp-database-backup for version...

WordPress Database Backup < 5.2 Remote Command Execution Exploit

There exists a command injection vulnerability in the Wordpress plugin wp-database-backup for versions less than 5.2. For the backup functionality, the plugin generates a mysqldump command to execute. The user can choose specific tables to exclude from the backup by setting the wpdbexcludetable...

CVE-2019-7667

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login...

CVE-2019-7667

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login...

CVE-2019-7667

CVE-2019-7667 affects Prima Systems FlexAir (versions 2.3.38 and prior). The flaw is that database backup files are created with predictable names, allowing brute-force identification of the backup file. An attacker could download the backup, obtain login information, and bypass authentication to...

CVE-2019-7667

Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force to identify the database backup file name. A malicious actor can exploit this issue to download the database file and disclose login...

PT-2019-18690 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The application generates database backup files with a predictable name, allowing an attacker to use brute force to identify the database backup file name. This can be exploited to...

WP Database Backup Plugin for WordPress < 5.2 Command Injection

The WordPress WP Database Backup Plugin installed on the remote host is affected by an operating system command injection vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's...

CVE-2019-12564

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames...

Design/Logic Flaw

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing approach for data/backup/DyyyymmddThhmmss.sql filenames...

CVE-2019-12564

CVE-2019-12564 affects DouCo DouPHP v1.5 Release 20190516. The issue allows remote attackers to view database backups by brute-forcing filenames data/backup/DyyyymmddThhmmss.sql, leading to partial/backup data exposure. Connected Red Hat and NVD entries corroborate the vulnerability description; ...

WordPress WP Database Backup plugin <= 5.1.2 - Unauthenticated OS Command Injection vulnerability

Unauthenticated OS Command Injection vulnerability found by WordFence in WordPress WP Database Backup plugin versions = 5.1.2. Solution Update the WordPress WP Database Backup plugin to the latest available version at least 5.2...

CVE-2018-14729

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

CVE-2018-14729

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

CVE-2018-14729

The database backup feature in upload/source/admincp/admincpdb.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code...

CVE-2018-14729

The CVE-2018-14729 entry affects Discuz! versions 2.5 and 3.4, where the database backup feature in upload/source/admincp/admincp_db.php enables remote attackers to execute arbitrary PHP code. The Red Hat, NVD, CVE list, and CNVD records confirm this backend command execution risk originates from...

WP Database Backup <= 5.1.2 - Unauthenticated OS Command Injection

The WP Database Backup WordPress plugin was affected by an Unauthenticated OS Command Injection security vulnerability...

Zikula Core CMS 2.0.13 Database Disclosure

Exploit Title : Zikula Core CMS 2.0.13 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 20/04/2019 Vendor Homepage : ziku.la Software Download Link : github.com/zikula/core/releases/download/2.0.13/2.0.zip Software Information Link :...

NIT-Warangal Dispensary Management System India 1.0 Database Disclosure

Exploit Title : NIT-Warangal Dispensary Management System India 1.0 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 15/04/2019 Vendor Homepage : nitw.ac.in Software Download Link : github.com/NIT-Warangal/DispensaryMS/archive/master.zip Sofwa...

Themosis Framework BookStore 1.3.0 Database Disclosure

Exploit Title : Themosis Framework BookStore 1.3.0 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 10/04/2019 Vendor Homepage : framework.themosis.com Software Download Link : github.com/themosis/bookstore/archive/master.zip Software...