The Duplicator installer writes the database name, user, password, host and port, and the new site URL and paths submitted during the database/update steps into wp-config.php without escaping. An unauthenticated attacker who can reach a leftover installer.php or installer-backup.php can inject PHP code into wp-config.php and achieve remote code execution.
This vulnerability affects the following application versions:
- Duplicator 1.2.0
- Duplicator 1.2.2
- Duplicator 1.2.4
- Duplicator 1.2.6
- Duplicator 1.2.8
- Duplicator 1.2.10
- Duplicator 1.2.12
- Duplicator 1.2.14
- Duplicator 1.2.16
- Duplicator 1.2.18
- Duplicator 1.2.20
- Duplicator 1.2.22
- Duplicator 1.2.24
- Duplicator 1.2.26
- Duplicator 1.2.28
- Duplicator 1.2.30
- Duplicator 1.2.32
- Duplicator 1.2.34
- Duplicator 1.2.36
- Duplicator 1.2.38
- Duplicator 1.2.40
- Duplicator 1.2.42
- Duplicator 1.2.44
- Duplicator 1.2.46
- Duplicator 1.2.48
- Duplicator 1.2.50
- Duplicator 1.2.52