CVE-2023-6553: fallo crítico en inisev BackupBliss – Backup & Migration with…
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 98%
de la publicación al armael mismo día
Publicada en NVD15 dic
1ª PoC13 dic
metasploit11 dic
VulnCheck+1d
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
inisev · BackupBliss – Backup & Migration with Free Cloud StoragePoCs públicas encontradas — 17
exploitdbwww.exploit-db.com/exploits/52486no verificadogithubgithub.com/Chocapikk/CVE-2023-6553★ 87githubgithub.com/motikan2010/CVE-2023-6553-PoC★ 4githubgithub.com/0x00phantom-hat/CVE-2023-6553-RCE-Exploit★ 2githubgithub.com/joaoaugustom/WordPress_Backup_Migration-RCE_Unauthenticated★ 0githubgithub.com/Harshit-Mashru/CVE-2023-6553★ 0githubgithub.com/Dungsocool/CVE-2023-6553★ 0githubgithub.com/cc3305/CVE-2023-6553★ 0cve_referencepacketstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.htmlno verificadovulncheckvulncheck.com/xdb/71f94fe09c5bno verificadovulncheckvulncheck.com/xdb/e6b3a983d3b2no verificadovulncheckvulncheck.com/xdb/e6fdf716d949no verificadovulncheckvulncheck.com/xdb/d01407f9af85no verificadovulncheckvulncheck.com/xdb/99deaf52bf21no verificadovulncheckvulncheck.com/xdb/2e94b4f633e7no verificadovulncheckvulncheck.com/xdb/f25701242e22no verificadovulncheckvulncheck.com/xdb/1df08bce3622no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — inisev BackupBliss – Backup & Migration with…
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-7002HIGHBackup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via urlEPSS 30.8%CVE-2023-6266HIGHBackup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information ExposureEPSS 2.1%CVE-2023-6972CRITICALBackup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File DeletionEPSS 1.4%CVE-2024-10932HIGHBackup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'EPSS 0.8%CVE-2023-0958MEDIUMInisev Plugins (Various Versions) - Missing Authorization on handle_installation functionEPSS 0.7%CVE-2023-3977MEDIUMInisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation functionEPSS 0.6%
Referencias
http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.htmlhttps://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail=https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-ithttps://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cve