PT-2019-12250 · Pluck · Pluck

Dk0N9O · Published 2019-04-19 · Updated 2019-04-22 · CVE-2019-11344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.8

Description The issue allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file. This is possible because only certain PHP-related filename extensions are blocked, leaving other extensions vulnerable to exploitation.

Recommendations For Pluck version 4.7.8, consider restricting the upload of .htaccess files or implementing additional checks to prevent the execution of arbitrary code through uploaded files. As a temporary workaround, restrict access to the data/inc/files.php file to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-11344

Affected Products

Pluck

References · 3

• 🔥 https://github.com/pluck-cms/pluck/issues/72 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-11344 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11344 · Vendor Advisory