CVE-2023-6971 Code injection in Backup Migration

High 8.1 Published 23 Dec 2023 Updated 2 Aug 2024

Unauthenticated attackers can achieve remote code execution via Remote File Inclusion if PHP allow_url_include is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6971?

CVE-2023-6971 is a high-severity code injection vulnerability in migrate Backup Migration, published on 23 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

Weakness: CWE-829

Which versions are affected by CVE-2023-6971?

It affects 1 product.

Products include Backupbliss Backup Migration.

How do I fix CVE-2023-6971?

No fix has been published for CVE-2023-6971 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-6971 being exploited?

There is no known exploitation of CVE-2023-6971 in the wild and no public exploit code.

Sources

Also known as GHSA-4vhp-8vcj-r74x.