Improper access control in SnapCreek Duplicator - #VU14790

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14790

Improper access control in SnapCreek Duplicator - #VU14790

Published: September 17, 2018


Vulnerability identifier: #VU14790
CSH Severity: Critical
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild
Vendor: SnapCreek
Affected software:
SnapCreek Duplicator

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to the web application does not restrict access to the installation script "/installer-backup.php" or "/installer.php" script. A remote unauthenticated attacker can upload malicious file via HTTP POST request and execute arbitrary PHP code on the target system.

Note: the vulnerability is being actively exploited in the wild in September 2018.

Remediation

Update to version 1.2.42.

Sources