WordPress XCloner - Backup and Restore Plugin Multiple Security Vulnerablities

Bugtraq ID:	70200
Class:	Input Validation Error
CVE:	CVE-2014-8605 CVE-2014-8606 CVE-2014-8607 CVE-2014-8604 CVE-2014-8603
Remote:	Yes
Local:	No
Published:	Sep 27 2014 12:00AM
Updated:	Jul 15 2015 12:29AM
Credit:	Larry W. Cashdollar
Vulnerable:
Not Vulnerable:

WordPress XCloner - Backup and Restore Plugin Multiple Security Vulnerablities

The XCloner - Backup and Restore plugin for WordPress is prone to multiple security vulnerabilities, including:

1. Multiple arbitrary command-execution vulnerabilities
2. An arbitrary file-download vulnerability
3. A directory-traversal vulnerability
4. Multiple information-disclosure vulnerabilities

An attacker may leverage these issues to execute arbitrary commands, to download arbitrary files from the web server, and obtain potentially sensitive information and that could aid in further attacks.

WordPress XCloner - Backup and Restore Plugin Multiple Security Vulnerablities

An attacker can use a browser to exploit these issues.

WordPress XCloner - Backup and Restore Plugin Multiple Security Vulnerablities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WordPress XCloner - Backup and Restore Plugin Multiple Security Vulnerablities

References:

• Vendor Homepage (XCloner)