Rapid7 Vulnerability & Exploit Database

WP Database Backup RCE

Back to Search

WP Database Backup RCE

Disclosed
04/24/2019
Created
07/23/2019

Description

There exists a command injection vulnerability in the Wordpress plugin `wp-database-backup` for versions < 5.2. For the backup functionality, the plugin generates a `mysqldump` command to execute. The user can choose specific tables to exclude from the backup by setting the `wp_db_exclude_table` parameter in a POST request to the `wp-database-backup` page. The names of the excluded tables are included in the `mysqldump` command unsanitized. Arbitrary commands injected through the `wp_db_exclude_table` parameter are executed each time the functionality for creating a new database backup are run. Authentication is required to successfully exploit this vulnerability.

Author(s)

  • Mikey Veenstra / Wordfence
  • Shelby Pace

Platform

Linux,Windows

Architectures

x86, x64

Development

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/wp_db_backup_rce
msf exploit(wp_db_backup_rce) > show targets
    ...targets...
msf exploit(wp_db_backup_rce) > set TARGET < target-id >
msf exploit(wp_db_backup_rce) > show options
    ...show and set options...
msf exploit(wp_db_backup_rce) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;