automatic module_metadata_base.json update

db/modules_metadata_base.json

@@ -70458,6 +70458,55 @@
     "notes": {
     }
   },
+  "exploit_multi/php/wp_duplicator_code_inject": {
+    "name": "Snap Creek Duplicator WordPress plugin code injection",
+    "full_name": "exploit/multi/php/wp_duplicator_code_inject",
+    "rank": 0,
+    "disclosure_date": "2018-08-29",
+    "type": "exploit",
+    "author": [
+      "Julien Legras <julien.legras@synacktiv.com>",
+      "Thomas Chauchefoin <thomas.chauchefoin@synacktiv.com>"
+    ],
+    "description": "When the WordPress plugin Snap Creek Duplicator restores a backup, it\n        leaves dangerous files in the filesystem such as installer.php and\n        installer-backup.php. These files allow anyone to call a function that\n        overwrite the wp-config.php file AND this function does not sanitize\n        POST parameters before inserting them inside the wp-config.php file,\n        leading to arbitrary PHP code execution.\n        WARNING: This exploit WILL break the wp-config.php file. If possible try\n        to restore backups of the configuration after the exploit to make the\n        WordPress site work again.",
+    "references": [
+      "URL-https://www.synacktiv.com/ressources/advisories/WordPress_Duplicator-1.2.40-RCE.pdf",
+      "WPVDB-9123",
+      "CVE-2018-17207"
+    ],
+    "is_server": true,
+    "is_client": false,
+    "platform": "PHP",
+    "arch": "php",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "WordPress Duplicator <= 1.2.40"
+    ],
+    "mod_time": "2018-12-11 11:59:19 +0000",
+    "path": "/modules/exploits/multi/php/wp_duplicator_code_inject.rb",
+    "is_install_path": true,
+    "ref_name": "multi/php/wp_duplicator_code_inject",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+    }
+  },
   "exploit_multi/postgres/postgres_createlang": {
     "name": "PostgreSQL CREATE LANGUAGE Execution",
     "full_name": "exploit/multi/postgres/postgres_createlang",