Snap Creek Duplicator <1.2.42 - Code Injection
Title source: llmExploitation Summary
CVE-2018-17207 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 2 public exploits from researchers including cved-sources, Julien Legras <[email protected]>, Thomas Chauchefoin <[email protected]>, including a Metasploit module exploits/multi/php/wp_duplicator_code_inject.
A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2018-17207, a vulnerability in the WordPress Duplicator plugin, by sending crafted POST requests to the installer.php endpoint to achieve unauthorized database manipulation and potential remote code execution.
Description
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
Exploits (2)
This PoC exploits CVE-2018-17207, a vulnerability in the WordPress Duplicator plugin, by sending crafted POST requests to the installer.php endpoint to achieve unauthorized database manipulation and potential remote code execution.
This Metasploit module exploits a code injection vulnerability in the Snap Creek Duplicator WordPress plugin (CVE-2018-17207) by overwriting the wp-config.php file with arbitrary PHP code. It leverages the installer.php or installer-backup.php files left by the plugin to inject a payload, leading to remote code execution.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H