PT-2007-5375 · Pluck · Pluck

Published 2007-08-08 · Updated 2024-08-07 · CVE-2007-4180

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pluck version 4.3

Description The issue allows remote attackers to potentially read arbitrary local files via a .. (dot dot) in the file parameter in the data/inc/theme.php file when register globals is enabled. However, it's noted that the code uses a fixed argument when invoking fputs, which cannot be used to read files, thus disputing the vulnerability.

Recommendations For Pluck version 4.3, consider disabling the register globals setting to minimize potential risks, as the vulnerability is contingent upon this setting being enabled. Additionally, restrict access to the data/inc/theme.php file to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-4180

Affected Products

Pluck

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-4180 · Security Note
• https://t.me/cvenotify/89693 · Telegram Post
• http://securityfocus.com/archive/1/475323/100/0/threaded · Note
• http://outlaw.aria-security.info/?p=12 · Note
• http://attrition.org/pipermail/vim/2007-August/001752.html · Note
• http://securityreason.com/securityalert/2973 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35757 · Note