Published: 15/12/2023 Updated: 18/01/2024

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated malicious users to easily execute code on the server.

Vulnerable Product	Search on Vulmon	Subscribe to Product
backupbliss backup migration

Check Point Reference: CPAI-2023-1400 Date Published: 18 Dec 2023 Severity: Critical ...

This Metasploit module exploits an unauthenticated remote command execution vulnerability in WordPress Backup Migration plugin versions 137 and below The vulnerability is exploitable through the Content-Dir header which is sent to the /wp-content/plugins/backup-backup/includes/backup-heartphp endpoint The exploit makes use of a neat technique ...

WordPress Backup Migration plugin versions 137 and below suffer from a remote code execution vulnerability ...

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

CVE-2023-6553 Exploit V2 🚀 Description 📝 The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 137 via the /includes/backup-heartphp file An attacker can control the values passed to an include statement, leveraging that to achieve remote code execution This vulnerability allows unauthenticated attacker

BACKUP-MIGRATION RCE EXPLOIT

CVE 2023-6553 WORDPRESS EXPLOIT The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 137 via the /includes/backup-heartphp file An attacker can control the values passed to an include statement, leveraging that to achieve remote code execution This vulnerability allows unauthenticated attackers to execute co

CVE-2023-6553 PoC (LFI to RCE) Unauthenticated Remote Code Execution in Backup Migration (WordPress Plugin) Run $ python exploitpy The following PHP script is executed <?php `date > outtxt`; ?> References Critical Unauthenticated Remote Code Execution Found in Backup Migrat

SCANNER CVE-2023-6553 The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 137 via the /includes/backup-heartphp file An attacker can control the values passed to an include statement, leveraging that to achieve remote code execution This vulnerability allows unauthenticated attackers to execute code on the

Writeups for kvvuctf 2024

CTF reverse 1 Гуру реверса - 1000 Платформа kvvuctf: Описание Разведчики перехватили аппаратуру шифрования противника, наши специалисты смогли восстановить [алгоритм](1064100100/download/reverse_1000py) проверки валидности клю

NVD-CWE-noinfo https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cve https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64 https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118 https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail=http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html https://nvd.nist.gov https://github.com/Chocapikk/CVE-2023-6553 https://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2023-1400.html

CVE-2023-6553

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect