CVE-2023-25828
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process before being available on the site. Due to lack of file extension validation, it is possible to upload a crafted JPEG payload containing an embedded PHP web-shell. An attacker may navigate to it directly to achieve RCE on the underlying web server. Administrator credentials for the Pluck CMS web interface are required to access the albums module feature, and are thus required to exploit this vulnerability. CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.2 High)
- Affected products
- Pluck Cms
- Pluck-cms Pluck
- < 4.7.16
- CVSS 3.1
- 7.2 HIGH
- EPSS
- 1.6% (74th percentile)
- Weakness
- CWE-434
- NVD status
- Modified
- Published
- 2023-03-27
- Attack patterns
- CAPEC-1
No indexed exploits for CVE-2023-25828 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2023-25828 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.