Dungsocool/CVE-2023-6553

GitHubRepository PoCExploit

PoC files

330 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a detailed technical writeup for CVE-2023-6553 that includes a fully functional exploit. The README.md provides step-by-step instructions and curl commands to achieve unauthenticated Remote Code Execution (RCE) on the Backup Migration WordPress plugin by sending a crafted POST request with a malicious 'Content-Dir' header to trigger a file inclusion vulnerability in backup-heart.php.

Backdoor review

No backdoor observed in reviewed code

The supplied text files consist of a vulnerability write-up (README.md) and source code for a WordPress plugin (Backup Migration) and an analytics SDK (Analyst). The README describes a legitimate file inclusion vulnerability (CVE-2023-6553) and provides a proof-of-concept exploit. The source code files are standard plugin components: an autoloader, SDK resolver, main plugin file, and uninstaller. No evidence of concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads was observed in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPHPShellMarkdown
Target softwareBackup Migration WordPress Plugin (backup-backup)
Attack typesRemote Code ExecutionFile Inclusion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The README.md contains explicit, executable curl commands that, when sent to a vulnerable server, trigger the file inclusion vulnerability to achieve Remote Code Execution. This is code intended to exercise a vulnerability, meeting the definition of an exploit.

README.md:253-274README.md:244-246

Requirements

  • A PHP file must be placed on the target server at a path predictable from the Content-Dir header, such as /tmp/bmi/includes/bypasser.php.README.md:239-247
  • The target must be running a vulnerable version of the Backup Migration plugin (<= 1.3.7).README.md:5

Observed behavior

  • Sends a single POST request to /wp-content/plugins/backup-backup/includes/backup-heart.php with a crafted Content-Dir header pointing to an attacker-controlled directory.README.md:253-274
  • The server includes and executes the attacker's PHP file (bypasser.php) located in the specified directory, resulting in arbitrary command execution.README.md:244-246README.md:280
  • Demonstrates impact by reading wp-config.php database credentials and gathering system information (uname, hostname).README.md:287-289README.md:307-309
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Writeup
README.md describes CVE-2023-6553, a file inclusion vulnerability in the Backup Migration plugin, and provides a PoC exploit.The write-up is a standard security research document explaining the vulnerability and demonstrating exploitation for educational purposes. It does not contain instructions for backdooring the reader's system.README.md:1-375
Source Code
wp-src/backup-backup.php is the main plugin file for Backup Migration v1.3.7.The file defines constants, includes required files, and initializes the plugin. It does not contain any obfuscated or suspicious code.wp-src/backup-backup.php:1-69
Source Code
wp-src/analyst/ directory contains an analytics SDK (Analyst) with autoloader, main initialization, and SDK resolver.These files are a standard third-party analytics library for WordPress plugins. They handle SDK version resolution and account registration. No backdoor behavior is present.wp-src/analyst/autoload.php:1-40wp-src/analyst/main.php:1-36wp-src/analyst/sdk_resolver.php:1-79
Source Code
wp-src/uninstall.php handles cleanup on plugin uninstallation.The file deletes backup files and configuration based on user settings. It is a standard uninstall routine.wp-src/uninstall.php:1-70
Review boundaries

What the analysis did not establish

  • The evidence packet contains one binary archive (CVE20276553.zip) that was not analyzed; its contents are unknown.
  • The analysis is based on the selected text files; 245 other files in the repository were not inspected.
  • One binary file (CVE20276553.zip, 1.3 MB) was flagged as BINARY and not analyzed. Its contents are unknown.
  • Only 8 of 330 files in the repository were included as text; the remaining 322 files (including 76 non-text media files) were not reviewed.
  • The review is limited to static analysis of the supplied text; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

3