'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>
 
   
 

vul_app:wordpress_backupbuddy_scrip_vul（Rule ID：1070210017）

Release Date：2025/9/15

Rule Name：CVE-2013-2741: WordPress BackupBuddy Plugin Importbuddy.php Scripting Authorization Vulnerability

Severity：high

CVE ID：CVE-2013-2741

 

Descripiton：

WordPress is a free and open-source content management system (CMS based on PHP and MySQL. WordPress is installed on a Web server that is either a part of an Internet hosting service or a network host in its own right. Importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request. This rule supports to defend the A6: Vulnerable and Outdated Components and A7: Identification and Authentication Failures of OWASP Top 10 - 2021.
Other reference：None

 

Solution：

Update vendor patches.