There is a lack of data validation on the BackWPUpJobTemp POST
parameter of job/wp_export_generate.php allowing an attacker to
specify FTP resources as input.
This resource is downloaded and deserialised by the wp_export_generate.php
script and variables from this deserialisation are later passed to
require_once.
Proof of Concept.
-================
Upload the following to a publicly accessible FTP server and
name it "file.txt.running".
The string included in $infile['ABS_PATH'] will then have "wp-load.php"
appended to it and passed to require_once.
In the above example the code contained in the base64 encoded string will
then be executed. The above code executes .phpinfo(); die();..
allow_URL_include will need to be on to allow to allow for remote file
inclusion, however local file inclusion could easily be achieved by using
null byte injection.
