PT-2023-20941 · Pluck Cms · Pluck Cms

Published 2023-06-22 · Updated 2023-06-30 · CVE-2023-27083

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pluck CMS versions 4.7.15 through 4.7.16-dev5

Description A remote code execution issue was found in the /admin.php file of Pluck CMS, allowing attackers to execute arbitrary code through the manage file functionality.

Recommendations For Pluck CMS versions 4.7.15 through 4.7.16-dev5, consider disabling the manage file functionality in /admin.php until a patch is available. Restrict access to the /admin.php file to minimize the risk of exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-27083

Affected Products

Pluck Cms

References · 5

• 🔥 https://medium.com/@syed.pentester/authenticated-remote-code-execution-rce-on-pluckcms-4-7-15-c309ac1bd145 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-27083 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27083 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27083 · Note
• https://medium.com/%40syed.pentester/authenticated-remote-code-execution-rce-on-pluckcms-4-7-15-c309ac1bd145 · Note