WordPress Backup Migration Plugin PHP Filter Chain RCE
Title source: metasploitExploitation Summary
CVE-2023-6553 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 9 public exploits from researchers including dangwenjing, Chocapikk, motikan2010, including a Metasploit module exploits/multi/http/wp_backup_migration_php_filter.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated RCE in WordPress Backup Migration plugin (≤1.3.7) via PHP filter chain manipulation through the Content-Dir header. It writes a payload character-by-character to bypass size limitations and achieves remote code execution.
Description
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
Exploits (9)
This Metasploit module exploits an unauthenticated RCE in WordPress Backup Migration plugin (≤1.3.7) via PHP filter chain manipulation through the Content-Dir header. It writes a payload character-by-character to bypass size limitations and achieves remote code execution.
This repository contains a functional Python exploit for CVE-2023-6553, targeting the Backup Migration WordPress plugin. The exploit leverages a file inclusion vulnerability in `/includes/backup-heart.php` to achieve unauthenticated remote code execution (RCE) via PHP filter chains.
This repository contains a functional exploit for CVE-2023-6553, demonstrating an unauthenticated LFI to RCE vulnerability in the Backup Migration WordPress plugin. The exploit leverages PHP filter chains to achieve remote code execution.
This repository contains functional exploit code for CVE-2023-6553, an unauthenticated RCE vulnerability in the WordPress Backup Migration plugin (≤1.3.7). The exploit leverages a PHP filter chain via the Content-Dir header to achieve remote code execution.
This repository contains functional exploit code for CVE-2023-6553, an unauthenticated RCE vulnerability in the WordPress Backup Migration plugin (≤1.3.7). The exploit leverages a PHP filter chain via the Content-Dir header to achieve remote code execution.
This repository contains a functional exploit for CVE-2023-6553, an unauthenticated RCE vulnerability in the WordPress Backup Migration plugin (<=1.3.7). The exploit leverages a PHP filter chain to write a webshell and includes both interactive shell and reverse shell capabilities.
This repository contains a functional exploit for CVE-2023-6553, a critical unauthenticated remote code execution vulnerability in the WordPress Backup plugin (versions <= 1.3.7). The exploit leverages PHP filter chains to bypass restrictions and achieve RCE via crafted HTTP requests.
This repository contains a functional Python exploit for CVE-2023-6553, targeting the Backup Migration WordPress plugin. The exploit leverages a PHP filter chain to achieve unauthenticated remote code execution via a vulnerable include statement in backup-heart.php.
This Metasploit module exploits an unauthenticated RCE vulnerability in the WordPress Backup Migration plugin (versions <= 1.3.7) via PHP filter chaining. It sends a malicious payload through the Content-Dir header to achieve remote code execution.
Nuclei Templates (1)
http.html:/wp-content/plugins/backup-backup/
body=/wp-content/plugins/backup-backup/
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H