CVE-2014-8606
XCloner 3.1.1 and 3.5.1 - Authenticated Path Traversal via File Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-8606.
AI-analyzed exploit summary This is a detailed technical analysis of multiple vulnerabilities in XCloner WordPress/Joomla! backup plugin, including arbitrary command execution via unsanitized input in exec() calls, cleartext MySQL password exposure, and predictable backup file names. The advisory includes vulnerable code snippets and root cause analysis.
Description
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.
Exploits (1)
This is a detailed technical analysis of multiple vulnerabilities in XCloner WordPress/Joomla! backup plugin, including arbitrary command execution via unsanitized input in exec() calls, cleartext MySQL password exposure, and predictable backup file names. The advisory includes vulnerable code snippets and root cause analysis.