PT-2024-30070 · Pligg Cms · Pligg Cms

Published 2024-08-20 · Updated 2025-04-21 · CVE-2024-42619

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pligg CMS version 2.0.2

Description A Cross-Site Request Forgery (CSRF) issue was discovered in Pligg CMS. The vulnerability can be exploited via the /admin/domain management.php endpoint with specific parameters such as id, list, and remove. For example, the id parameter is set to 0, the list parameter to whitelist, and the remove parameter to a specific domain like pligg.com. This allows for unauthorized actions.

Recommendations For Pligg CMS version 2.0.2, as a temporary workaround, consider restricting access to the /admin/domain management.php endpoint until a patch is available. Avoid using the remove parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-42619

Affected Products

Pligg Cms

References · 7

• 🔥 https://github.com/jinwu1234567890/cms2/tree/main/17/readme.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-42619 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42619 · Security Note
• https://twitter.com/CVEnew/status/1825960865075499399 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1825995906967015791 · Twitter Post
• https://t.me/cvedetector/3678 · Telegram Post
• https://t.me/cvenotify/119156 · Telegram Post