PT-2023-20333 · Pluck Cms · Pluck Cms

Matthew Hogg · Published 2023-03-27 · Updated 2023-05-31 · CVE-2023-25828

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pluck CMS (affected versions not specified)

Description The issue concerns an authenticated remote code execution (RCE) vulnerability through the "albums" module. This module allows the creation of image collections that can be inserted into web pages. Due to a lack of file extension validation, an attacker can upload a crafted JPEG payload containing an embedded PHP web-shell, which can be accessed directly to achieve RCE on the underlying web server. Administrator credentials are required to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-25828

Affected Products

Pluck Cms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-25828 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25828 · Vendor Advisory
• https://synopsys.com/blogs/software-security/pluck-cms-vulnerability · Patch
• https://t.me/secharvester/13842 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25828 · Note
• https://t.me/defcon_news/114266 · Telegram Post
• https://t.me/rnetsec/18768 · Telegram Post
• https://t.me/cibsecurity/60815 · Telegram Post
• https://t.me/thebugbountyhunter/7387 · Telegram Post