PT-2008-5193 · Pluck · Pluck Cms

Publicado 2008-08-27 · Atualizado 2018-10-11 · CVE-2008-3851

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pluck CMS version 4.5.2

Description The issue involves multiple directory traversal vulnerabilities that allow remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot backslash) in the blogpost, cat, and file parameters to "data/inc/themes/predefined variables.php", as well as the blogpost and cat parameters to "data/inc/blog include react.php", both of which are reachable through "index.php".

Recommendations For Pluck CMS version 4.5.2, consider restricting access to the vulnerable parameters blogpost, cat, and file in the affected API endpoints until a patch is available. As a temporary workaround, avoid using these parameters in "data/inc/themes/predefined variables.php" and "data/inc/blog include react.php" to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3851

Produtos afetados

Pluck Cms

Referências · 8

• 🔥 https://exploit-db.com/exploits/6300 · Exploit
• 🔥 http://securityfocus.com/bid/30820 · Exploit
• http://secunia.com/advisories/31607 · Aviso do Fabricante
• http://securityreason.com/securityalert/4195 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3851 · Nota de Segurança
• http://securityfocus.com/archive/1/495706/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44677 · Nota
• http://pluck-cms.org/releasenotes.php#4.5.3 · Nota