Wordpress CherryFramework Themes 3.1.4 - Backup File Download

vendor:

CherryFramework Themes

by:

b1p0l4r

2.6

CVSS

LOW

Information Disclosure

200

CWE

Product Name: CherryFramework Themes

Affected Version From: 3.x.x

Affected Version To: 3.1.4

Patch Exists: NO

Related CWE: N/A

CPE: a:cherryframework:cherry_framework_themes

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 18.0.4.1

2018

WordPress CherryFramework Themes 3.1.4 – Backup File Download

The CherryFramework Cherry theme 3.1.4 for WordPress allow remote attackers to obtain potentially sensitive information via wp-content/themes/CherryFramework/admin/data_management/ download_backup.php because it offers the option of a ZIP archive containing the entire content of the wp-content/themes directory.

Mitigation:

Ensure that the download_backup.php file is not accessible to unauthorized users.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress CherryFramework Themes 3.1.4 - Backup File Download
# Google Dork: inurl:/wp-content/themes/CherryFramework
# Date: 2018-11-17
# Exploit Author: b1p0l4r
# Vendor Homepage: http://www.cherryframework.com/
# Software Link: http://www.cherryframework.com/
# Version: 3.x.x > 3.1.4
# Tested on: Ubuntu 18.0.4.1
# CVE : N/A

# The CherryFramework Cherry theme 3.1.4 for WordPress allow
# remote attackers to
# obtain potentially sensitive information via
# wp-content/themes/CherryFramework/admin/data_management/ download_backup.php
# because it
# offers the option of a ZIP archive containing the entire content of the wp-content/themes directory.

# [PoC]
# just open that files/link and then showing the popup for saving a .ZIP file
# EXAMPLE LINK = 

https://www.victim.com/wp-content/themes/CherryFramework/admin/data_management/download_backup.php 

# IndoXploit, ZeroByte.ID, Eldersc0de Family, Exploiter Xero Team