Advertisement






WordPress CherryFramework Themes 3.1.4 Backup File Download

CVE Category Price Severity
CVE-XXXX-XXXX CWE-XXX Not specified Not specified
Author Risk Exploitation Type Date
Not specified Not specified Remote 2018-11-22
CPE
cpe:cpe:2.3:a:wordpress:cherryframework:3.1.4:*:*:*:*:wordpress:*:*
CVSS EPSS EPSSP
CVSS:7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 0.573 0.904

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2018110184

Below is a copy:

WordPress CherryFramework Themes 3.1.4 Backup File Download
# Exploit Title: Wordpress CherryFramework Themes 3.1.4 - Backup File Download
# Google Dork: inurl:/wp-content/themes/CherryFramework
# Date: 2018-11-17
# Exploit Author: b1p0l4r
# Vendor Homepage: http://www.cherryframework.com/
# Software Link: http://www.cherryframework.com/
# Version: 3.x.x > 3.1.4
# Tested on: Ubuntu 18.0.4.1
# CVE : N/A
 
# The CherryFramework Cherry theme 3.1.4 for WordPress allow
# remote attackers to
# obtain potentially sensitive information via
# wp-content/themes/CherryFramework/admin/data_management/ download_backup.php
# because it
# offers the option of a ZIP archive containing the entire content of the wp-content/themes directory.
 
# [PoC]
# just open that files/link and then showing the popup for saving a .ZIP file
# EXAMPLE LINK = 
 
https://www.victim.com/wp-content/themes/CherryFramework/admin/data_management/download_backup.php 
 
# IndoXploit, ZeroByte.ID, Eldersc0de Family, Exploiter Xero Team


Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.