CVE-2023-27083

Published: Jun 22, 2023Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.

Affected (7)

Products: Pluck Cms: Pluck

Pluck Cms

1 product

Pluck

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Pluck Cms Pluck	From 4.7.15 to 4.7.16
Pluck Cms Pluck	Version 4.7.16
Pluck Cms Pluck	Version 4.7.16 dev1
Pluck Cms Pluck	Version 4.7.16 dev2
Pluck Cms Pluck	Version 4.7.16 dev3
Pluck Cms Pluck	Version 4.7.16 dev4
Pluck Cms Pluck	Version 4.7.16 dev5

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://medium.com/%40syed.pentester/authenticated-remote-code-execution-rce-on-pluckcms-4-7-15-c309ac1bd145

Source: cve@mitre.org

https://medium.com/%40syed.pentester/authenticated-remote-code-execution-rce-on-pluckcms-4-7-15-c309ac1bd145

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.