cve/2020/CVE-2020-11738.md

CVE-2020-11738

Description

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

POC

Reference

• http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
• http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
• http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html
• http://packetstormsecurity.com/files/164533/WordPress-Duplicator-1.3.26-Arbitrary-File-Read.html

Github

• https://github.com/0day404/vulnerability-poc
• https://github.com/20142995/Goby
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/ArrestX/--POC
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/HimmelAward/Goby_POC
• https://github.com/KayCHENvip/vulnerability-poc
• https://github.com/Live-Hack-CVE/CVE-2020-11738
• https://github.com/Miraitowa70/POC-Notes
• https://github.com/Ostorlab/KEV
• https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
• https://github.com/Shamsuzzaman321/Wordpress-Exploit-AiO-Package
• https://github.com/Sleleu/HeroCTF_WriteUp
• https://github.com/Threekiii/Awesome-POC
• https://github.com/VTFoundation/vulnerablewp
• https://github.com/Z0fhack/Goby_POC
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/merlinepedra/nuclei-templates
• https://github.com/merlinepedra25/nuclei-templates
• https://github.com/sobinge/nuclei-templates
• https://github.com/waleedzafar68/vulnerablewp