Product: WordPress plugin EZPZ One Click Backup
Vulnerability type: CWE-78 OS Command Injection
Vulnerable versions: 12.03.10 and some earlier versions
Fixed version: N/A
Solution: Remove plugin
Vendor notification: Contact details N/A
WordPress plugins team notification: 2014-04-30
Risk: High
CVE: CVE-2014-3114
Vulnerability Details:
Contains a flaw that is triggered as input passed via the 'cmd' parameter in
ezpz-archive-cmd.php is not properly sanitized. With a specially crafted
request, an unauthenticated remote attacker can execute arbitrary commands
directly on the operating system.
http://plugins.svn.wordpress.org/ezpz-one-click-backup/tags/12.03.10/functions/ezpz-archive-cmd.php
1 <?php
2 if (isset($_GET['cmd'])){
3 exec(urldecode($_GET['cmd']));
4 tmp_write("<h2>Running zip page...<h2>");
5 }
6
7 ?>
Steps to reproduce:
http://example.com/wp-content/plugins/ezpz-one-click-backup/functions/ezpz-archive-cmd.php?cmd=uptime
Notes:
Plugin can't be downloaded anymore by using WordPress admin panel or from links
below, but still used by many as per:
inurl:"/wp-content/plugins/ezpz-one-click-backup/"
https://wordpress.org/plugins/ezpz-one-click-backup/
http://downloads.wordpress.org/plugin/ezpz-one-click-backup.latest-stable.zip
From the developer's website 2012-04-27:
"""
Do to recent changes in the Dropbox API, EZPZ One Click Backup can no longer
save files to Dropbox.
I apologize but due to various reasons there will be no new versions released or
further support for EZPZ OCB in the foreseeable future.
For a reliable, inexpensive alternative I recommend trying MyRepono and the
MyRepono Plugin. This service, while not entirely free (the fees are as low as
2¢ a day for a small site), works great on WordPress sites as large as 5GB,
maybe even larger. MyRepono gives a $5.00 credit when signing up for the service
so there is no cost to try it out.
Again, I apologize to all EZPZ One Click Backup users and wish you all the best.
"""
Might be related:
http://wordpress.org/support/topic/plugin-ezpz-one-click-backup-possible-security-flaw
---
Henri Salo
