Lucene search
Ihsan SencanWPEX-ID:F27D753E-861A-4D8D-9B9A-6C99A8A7EBE0HistoryAug 01, 2022 - 12:00 a.m.
Duplicator < 1.4.7 - Unauthenticated Backup Download
2022-08-0100:00:00
Ihsan Sencan
90
0.664 Medium
EPSS
Percentile
98.0%
The plugin discloses the url of the a backup to unauthenticated visitors accessing the main installer endpoint of the plugin, if the installer script has been run once by an administrator, allowing download of the full site backup without authenticating.
Find the URL of the actual installer script in the html returned by this endpoint: http://example.com/wp-content/backups-dup-lite/dup-installer/main.installer.php?is_daws=1
By changing the last part of the URL from '_installer.php' to '_archive.zip' the full backup is available.
As a bonus, by changing the last part of the URL from '_installer.php' to '.log', some information about the system is revealed.
Related
nuclei
nuclei
WordPress Duplicator <1.4.7 - Authentication Bypass
2022-09-03 19:19:55
prion
prion
Design/Logic Flaw
2022-08-22 15:15:00
wpvulndb
wpvulndb
Duplicator < 1.4.7 - Unauthenticated Backup Download
2022-08-01 00:00:00
openvas
openvas
WordPress Duplicator Plugin < 1.4.7 Information Disclosure Vulnerability
2022-08-23 00:00:00
cvelist
cvelist
CVE-2022-2551 Duplicator < 1.4.7 - Unauthenticated Backup Download
2022-08-22 15:03:52
nvd
nvd
CVE-2022-2551
2022-08-22 15:15:15
cve
cve
CVE-2022-2551
2022-08-22 15:15:15
zdt
zdt
patchstack
patchstack
packetstorm
packetstorm
WordPress Duplicator 1.4.6 Backup Disclosure
2022-08-01 00:00:00
exploitdb
exploitdb
WordPress Plugin Duplicator 1.4.6 - Unauthenticated Backup Download
2022-08-01 00:00:00