CVE-2023-50564

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50564
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/SecBridge/Cms_Vuls_test/blob/main/Pluckcms/Pluck_v4.7.18_Any_File_Upload_Getshell.md Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:pluck-cms:pluck:4.7.18:-:*:*:*:*:*:*
History

18 Dec 2023, 19:49

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de carga de archivos arbitrarios en el componente /inc/modules_install.php de Pluck-CMS v4.7.18 permite a los atacantes ejecutar código arbitrario cargando un archivo ZIP manipulado.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
First Time Pluck-cms
Pluck-cms pluck
CWE CWE-434
References () https://github.com/SecBridge/Cms_Vuls_test/blob/main/Pluckcms/Pluck_v4.7.18_Any_File_Upload_Getshell.md - () https://github.com/SecBridge/Cms_Vuls_test/blob/main/Pluckcms/Pluck_v4.7.18_Any_File_Upload_Getshell.md - Exploit
CPE cpe:2.3:a:pluck-cms:pluck:4.7.18:-:*:*:*:*:*:*

14 Dec 2023, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-14 15:15

Updated : 2023-12-18 19:49

NVD link : CVE-2023-50564

Mitre link : CVE-2023-50564

CVE.ORG link : CVE-2023-50564

JSON object : View

Products Affected

pluck-cms

  • pluck
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type