Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003
From: Henri Salo <henri () nerv fi>
Date: Thu, 1 Dec 2011 02:31:32 +0200

On Mon, Mar 28, 2011 at 03:10:39PM +1100, Lists wrote:
Sense of Security - Security Advisory - SOS-11-003

Release Date.                  28-Mar-2011
Last Update.                   -
Vendor Notification Date.      25-Mar-2010
Product.                       Wordpress Plugin BackWPup
Platform.                      Independent
Affected versions.             1.6.1 (verified), possibly others
Severity Rating.               High
Impact.                        System Access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to version 1.7.1
CVE reference.                 Not yet assigned

A vulnerability has been discovered in the Wordpress plugin BackWPup 
1.6.1 which can be exploited to execute local or remote code on the web 
server. The Input passed to the component "wp_xml_export.php" via the 
"wpabs" variable allows the inclusion and execution of local or remote 
PHP files as long as a "_nonce" value is known. The "_nonce" value 
relies on a static constant which is not defined in the script meaning 
that it defaults to the value "822728c8d9".

Proof of Concept.

Upgrade to version 1.7.1

Discovered by.
Phil Taylor - Sense of Security Labs.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info () senseofsecurity com au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:

Other Sense of Security advisories can be found at:


- Henri Salo

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • Re: Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability - SOS-11-003 Henri Salo (Dec 01)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]