DATABASE RESOURCES PRICING ABOUT US

{"id": "WPEX-ID:6A01C1E4-E9E3-4F42-9F84-A3A8C159890E", "type": "wpexploit", "bulletinFamily": "exploit", "title": "XCloner - Backup and Restore < 3.1.5 - Authenticated Path Traversal", "description": "Authenticated users are able to perform directory listings at any location available to the Wordpress user, leaking filenames of previous backups. This was found in XCloner - Backup and Restore version 3.1.4, but may have been introduced in earlier versions. Attackers can leverage directory listings to leak otherwise secret filepaths to previous backups, allowing them to acquire full backup contents, since the backup download is not authenticated.\n", "published": "2016-12-31T00:00:00", "modified": "2020-09-25T10:26:05", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "", "reporter": "ldionmarcil", "references": ["https://gist.github.com/ldionmarcil/b223bb39694019d6f35a601ed7f841bf", "https://plugins.trac.wordpress.org/changeset/1565339/xcloner-backup-and-restore"], "cvelist": [], "lastseen": "2021-02-15T22:22:20", "viewCount": 2, "enchantments": {"dependencies": {}, "score": {"value": -0.7, "vector": "NONE"}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.7}, "sourceData": "Log in as a regular, unprivileged user (subscriber):\r\n\r\n1. Visit http://wordpress/wp-admin/admin-ajax.php?action=files_xml.\r\n This is a XML file-listing of the root Wordpress installation, and its\r\n fullpath.\r\n2. Add a `dir` GET argument to the URL to browse to a specific directory. \r\n The length of this path has to be longer than the length of the `backup_path`\r\n configuration variable on the server, but this is bypassable by adding\r\n leading slashes to your path. ie: /foo/bar \u2192 /////////foo/bar, or until the\r\n length of your path exceeds the configuration one, using trial and error.\r\n In this case, we want to leak previous backups, so navigate to\r\n http://wordpress/wp-admin/admin-ajax.php?action=files_xml&dir=///////var/www/html/administrator/backups\r\n3. Backups will be enumerated here, you can then browse to their location\r\n Depending on previous steps, the URL would be something like this:\r\n http://wordpress/administrator/backups/{BACKUP_FILENAME}", "generation": 1, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646077724, "score": 1659842276, "epss": 1679062491}, "_internal": {"score_hash": "41649b4ea4294e4046d403527dc67c50"}}

{}