PT-2019-7737

Name of the Vulnerable Software and Affected Versions multisite-post-duplicator plugin versions prior to 1.1.3 Description The issue concerns a CSRF vulnerability in the multisite-post-duplicator plugin for WordPress. It affects the wp-admin/tools.php?page=mpd endpoint. Recommendations For versio...

CVE-2016-10944: Cross-Site Request Forgery (CSRF)

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...

WordPress Snap Creek Duplicator Code Injection (CVE-2018-17207)

An exploitable remote code execution vulnerability exists in WordPress Duplicator server. A WordPress plugin Snap Creek Duplicator restores a backup, resulting in remote code execution. An attacker can send a single authenticated HTTP request to trigger this vulnerability...

WordPress Snap Creek Duplicator Code Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Snap Creek Duplicator WordPress plugin code injection', 'Description' = %q When the WordPress plugin Snap Creek Duplicator restores a backup, it...

WordPress Snap Creek Duplicator Code Injection Exploit

When the WordPress plugin Snap Creek Duplicator restores a backup, it leaves dangerous files in the filesystem such as installer.php and installer-backup.php. These files allow anyone to call a function that overwrite the wp-config.php file AND this function does not sanitize POST parameters befo...

WordPress Duplicator Plugin < 1.2.42 RCE Vulnerability

An issue was discovered in Snap Creek Duplicator. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution. SPDX-FileCopyrightText: 2018 Greenbone AG Some tex...

Snap Creek Duplicator PHP Code Injection Vulnerability

Snap Creek Duplicator is a tool for migrating and backing up WordPress websites. A security vulnerability exists in Snap Creek Duplicator versions prior to 1.2.42. The vulnerability can be exploited by accessing the installer.php file and installer-backup.php file to inject PHP code into the...

CVE-2018-17207

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

CVE-2018-17207

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

Code injection

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

CVE-2018-17207

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

CVE-2018-17207

The Snap Creek Duplicator WordPress plugin (versions prior to 1.2.42 ) is vulnerable to arbitrary code execution due to leftover installer files, specifically installer.php and installer-backup.php, left in the filesystem after a backup restoration. An attacker can access these files to call a fu...

Snap Creek Duplicator RCE

The Snap Creek Duplicator plugin for Wordpress enables the possibility for code execution after a backup has been created. This affects versions prior to v1.2.42. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC reported: Details With over 1 million installations of this plugin in Wordpres...

PT-2018-13948

Name of the Vulnerable Software and Affected Versions Snap Creek Duplicator versions prior to 1.2.42 Description An issue allows an attacker to inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution by accessing leftover installer files, specifically...

CVE-2018-17207: Improper Control of Generation of Code

An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files installer.php and installer-backup.php, an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution...

Old WordPress Plugin Being Exploited in RCE Attacks

Researchers are warning that attackers are abusing a vulnerability in WordPress site admins’ outdated versions of a migration plugin called Duplicator – allowing them to execute remote code. Made by Snap Creek Software, all Duplicator plugins earlier than version 1.2.42 are vulnerable to the...

WordPress Duplicator Plugin Remote Code Execution

A Remote Code Execution vulnerability exists in the WordPress Duplicator Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. PoC actionajax=3step=3=nowhere=test=test=test'; fileputcontents"test.php", ' '; /=12345&...

Duplicator <= 1.2.40 - Unauthenticated Arbitrary Code Execution

If installer files, installer.php and installer-backup.php, are not removed by the administrators, a code injection during the database setup step allows to execute arbitrary code on the server. actionajax=3&actionstep=3&dbhost=nowhere&dbuser=test&dbpass=test&dbname=test';...

WordPress Duplicator plugin <= 1.2.40 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability found in WordPress Duplicator plugin versions = 1.2.40. Solution Update the WordPress Duplicator plugin to the latest available version at least 1.2.42...