id: wordpress-total-upkeep-backup-download

info:
  name: WordPress Total Upkeep Database and Files Backup Download
  author: princechaddha
  severity: high
  description: Exposed sensitive file in WordPress Total Upkeep wordpress plugin feature used.
  reference:
    - https://www.exploit-db.com/exploits/49252
  metadata:
    max-request: 1
  tags: wordpress,wp-plugin,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/boldgrid-backup/cron/restore-info.json"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "application/json"
        part: header

      - type: word
        words:
          - '"filepath"'
          - '/wp-content/boldgrid_backup_'
        condition: and
        part: body

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009c9f79f1d189c7f36292b9313fb9194c46a9e104c7b6aa9407cfae77bb24780202204497815b2cbee8c0fecf01a224d566dda87532f79e4539cab2ba1c911b1fdb11:922c64590222798bb761d5b6d8e72950