PT-2008-5193 · Pluck · Pluck Cms

Published 2008-08-27 · Updated 2018-10-11 · CVE-2008-3851

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pluck CMS version 4.5.2

Description The issue involves multiple directory traversal vulnerabilities that allow remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot backslash) in the blogpost, cat, and file parameters to "data/inc/themes/predefined variables.php", as well as the blogpost and cat parameters to "data/inc/blog include react.php", both of which are reachable through "index.php".

Recommendations For Pluck CMS version 4.5.2, consider restricting access to the vulnerable parameters blogpost, cat, and file in the affected API endpoints until a patch is available. As a temporary workaround, avoid using these parameters in "data/inc/themes/predefined variables.php" and "data/inc/blog include react.php" to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3851

Affected Products

Pluck Cms

References · 8

• 🔥 https://exploit-db.com/exploits/6300 · Exploit
• 🔥 http://securityfocus.com/bid/30820 · Exploit
• http://secunia.com/advisories/31607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3851 · Security Note
• http://securityreason.com/securityalert/4195 · Note
• http://securityfocus.com/archive/1/495706/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44677 · Note
• http://pluck-cms.org/releasenotes.php#4.5.3 · Note