PT-2013-3908 · Ithemes · Backupbuddy

Published 2013-04-02 · Updated 2013-04-02 · CVE-2013-2742

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BackupBuddy plugin versions 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4

Description The issue arises from the importbuddy.php script in the BackupBuddy plugin, which does not reliably delete itself after completing a restore operation. This oversight makes it easier for remote attackers to obtain access via subsequent requests to this script.

Recommendations For BackupBuddy plugin version 1.3.4, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.1.4, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.2.25, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.2.28, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access. For BackupBuddy plugin version 2.2.4, consider manually deleting the importbuddy.php script after a restore operation to prevent unauthorized access.

Exploit

Fix

Related Identifiers

CVE-2013-2742

Affected Products

Backupbuddy

References · 4

• 🔥 http://packetstormsecurity.com/files/120923 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2013-03/0205.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2742 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2742 · Note