CVE-2014-8605
XCloner 3.1.1 and 3.5.1 - Unauthenticated Sensitive Information Exposure via Predictable Backup File Names
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-8605.
AI-analyzed exploit summary This is a detailed technical analysis of multiple vulnerabilities in XCloner WordPress/Joomla! backup plugin, including arbitrary command execution via unsanitized input in exec() calls, cleartext MySQL password exposure, and predictable backup file names. The advisory includes vulnerable code snippets and proof-of-concept descriptions.
Description
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
Exploits (1)
This is a detailed technical analysis of multiple vulnerabilities in XCloner WordPress/Joomla! backup plugin, including arbitrary command execution via unsanitized input in exec() calls, cleartext MySQL password exposure, and predictable backup file names. The advisory includes vulnerable code snippets and proof-of-concept descriptions.