CVE-2018-17207

The Snap Creek Duplicator WordPress plugin (versions prior to 1.2.42 ) is vulnerable to arbitrary code execution due to leftover installer files, specifically installer.php and installer-backup.php, left in the filesystem after a backup restoration. An attacker can access these files to call a fu...

CVE-2018-17207

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

Snap Creek Duplicator RCE

The Snap Creek Duplicator plugin for Wordpress enables the possibility for code execution after a backup has been created. This affects versions prior to v1.2.42. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC reported: Details With over 1 million installations of this plugin in Wordpres...

CVE-2018-17207: Improper Control of Generation of Code

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

PT-2018-13948

Name of the Vulnerable Software and Affected Versions Snap Creek Duplicator versions prior to 1.2.42 Description An issue allows an attacker to inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution by accessing leftover installer files, specifically...

Old WordPress Plugin Being Exploited in RCE Attacks

Researchers are warning that attackers are abusing a vulnerability in WordPress site admins’ outdated versions of a migration plugin called Duplicator – allowing them to execute remote code. Made by Snap Creek Software, all Duplicator plugins earlier than version 1.2.42 are vulnerable to the...

WordPress Duplicator Plugin Remote Code Execution

A Remote Code Execution vulnerability exists in the WordPress Duplicator Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress Duplicator plugin <= 1.2.40 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability found in WordPress Duplicator plugin versions = 1.2.40. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.2.42...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. actionajax=3&actionstep=3&dbhost=nowhere&dbuser=test&dbpass=test&dbname=test';...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. PoC actionajax=3step=3=nowhere=test=test=test'; fileputcontents"test.php", ' '; /=12345&...

Snap Creek Duplicator WordPress plugin code injection

When the WordPress plugin Snap Creek Duplicator restores a backup, it leaves dangerous files in the filesystem such as installer.php and installer-backup.php. These files allow anyone to call a function that overwrite the wp-config.php file AND this function does not sanitize POST parameters befo...

WordPress Duplicator plugin <=1.2.32 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Duplicator plugin versions =1.2.32 Solution Update the WordPress Duplicator plugin to the latest available version at least 1.2.33...

CVE-2018-7543

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

CVE-2018-7543

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

CVE-2018-7543

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

CVE-2018-7543

CVE-2018-7543 is a cross-site scripting (XSS) vulnerability in the WordPress Duplicator plugin version 1.2.32. The issue lies in installer/build/view.step4.php where the json parameter can inject arbitrary JavaScript/HTML. Public references (Exploit-DB, PacketStorm, PatchStack) document a reflect...

PT-2018-18147

Name of the Vulnerable Software and Affected Versions SnapCreek Duplicator plugin version 1.2.32 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter in the...

CVE-2018-7543: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter...

WordPress Duplicator Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Duplicator plugin version 1.2.32, which can be exploited by an...