PT-2023-20333 · Pluck Cms · Pluck Cms

Matthew Hogg · Publicado 2023-03-27 · Atualizado 2023-05-31 · CVE-2023-25828

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pluck CMS (affected versions not specified)

Description The issue concerns an authenticated remote code execution (RCE) vulnerability through the "albums" module. This module allows the creation of image collections that can be inserted into web pages. Due to a lack of file extension validation, an attacker can upload a crafted JPEG payload containing an embedded PHP web-shell, which can be accessed directly to achieve RCE on the underlying web server. Administrator credentials are required to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-25828

Produtos afetados

Pluck Cms

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-25828 · Nota de Segurança
• https://t.me/secharvester/13842 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25828 · Nota
• https://t.me/defcon_news/114266 · Publicação no Telegram
• https://t.me/rnetsec/18768 · Publicação no Telegram
• https://t.me/cibsecurity/60815 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25828 · Aviso do Fabricante
• https://synopsys.com/blogs/software-security/pluck-cms-vulnerability · Correção
• https://t.me/thebugbountyhunter/7387 · Publicação no Telegram