CVE-2021-24155 PoC — Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload

Source

https://github.com/0dayNinja/CVE-2021-24155.rb

Associated Vulnerability

Title:Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload (CVE-2021-24155)
Description:The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.

Description

WordPress Backup Guard Authenticated Remote Code Execution Exploit

Readme

# WordPress-Backup-RCE

This Metasploit module allows an attacker with a privileged WordPress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard versions prior to 1.6.0. This is due to an incorrect check of the uploaded file extension which should be of SGBP type. Then, the uploaded payload can be triggered by a call to /wp-content/uploads/backup-guard/<random_payload_name>.php.

File Snapshot


 [4.0K]  /data/pocs/71eb98ebd53d0a93c38f202c7feb5f1f65ac2d68
├── [4.7K]  CVE-2021-24155.rb
└── [ 444]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!