PT-2008-4950 · Pluck · Pluck

Dr.Crash + 1 · Published 2008-08-10 · Updated 2018-10-11 · CVE-2008-3574

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pluck version 4.5.2

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can occur through various parameters in different PHP files, including lang footer in data/inc/footer.php, multiple parameters in data/inc/header.php and data/inc/header2.php, and lang theme6 in data/inc/themeinstall.php. The affected parameters are: lang footer, pluck version, lang install22, titelkop, lang kop1, lang kop2, lang modules, lang kop4, lang kop15, lang kop5, and lang theme6.

Recommendations For Pluck version 4.5.2, consider disabling the register globals setting to mitigate the risk of exploitation. As a temporary workaround, restrict access to the vulnerable parameters, such as lang footer, pluck version, lang install22, titelkop, lang kop1, lang kop2, lang modules, lang kop4, lang kop15, lang kop5, and lang theme6, in the affected PHP files until a patch is available. Avoid using these parameters in the "data/inc/footer.php", "data/inc/header.php", "data/inc/header2.php", and "data/inc/themeinstall.php" files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3574

Affected Products

Pluck

References · 6

• 🔥 https://exploit-db.com/exploits/32168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3574 · Security Note
• http://securityreason.com/securityalert/4125 · Note
• http://securityfocus.com/archive/1/495110/100/0/threaded · Note
• http://securityfocus.com/bid/30542 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44237 · Note