SB2019042404 - Multiple vulnerabilities in WP Database Backup plugin for WordPress

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions when a nonce check was required when the "wp-database-backup" page of a site’s admin dashboard was accessed. A remote attacker can modify backup configuration settings, including list tables that are to be excluded from the backup.

2) OS Command Injection (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing data passed via the "$wp_db_exclude_table" variable in mysqldump function when creating a command to execute the database dump  A remote authenticated attacker (but see vulnerability #1) can inject arbitrary OS commands, which are then executed when the plugin performs a database backup.

Chained exploitation of these two vulnerabilities may allow a remote non-authenticated attacker to execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-bac...