CVE-2008-3851

Pluck CMS 4.5.2 - Multiple Local File Inclusions

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file parameters to data/inc/themes/predefined_variables.php, as reachable through index.php; and the (4) blogpost and (5) cat parameters to data/inc/blog_include_react.php, as reachable through index.php. NOTE: the issue involving vectors 1 through 3 reportedly exists because of an incomplete fix for CVE-2008-3194.

Múltiples vulnerabilidades de salto de directorio en Pluck CMS 4.5.2 en Windows permite a atacantes remotos incluir y ejecutar archivos locales de su elección mediante ..\ (punto punto barra invertida) en los parámetros (1) blogpost, (2) cat y (3) file a data/inc/themes/predefined_variables.php, como se llega a él mediante index.php; y lso parámetros (4) blogpost Y (5) cat a data/inc/blog_include_react.php, del modo que se llega a ellos mediante index.php.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-08-27 CVE Reserved
2008-08-27 CVE Published
2024-07-28 EPSS Updated
2024-08-07 CVE Updated
2024-08-07 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (7)

URL	Tag	Source
http://securityreason.com/securityalert/4195	Third Party Advisory
http://www.pluck-cms.org/releasenotes.php#4.5.3	X_refsource_confirm
http://www.securityfocus.com/archive/1/495706/100/0/threaded	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/44677	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/6300	2024-08-07
http://www.securityfocus.com/bid/30820	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/31607	2018-10-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pluck Search vendor "Pluck"	Pluck Search vendor "Pluck" for product "Pluck"	4.5.2 Search vendor "Pluck" for product "Pluck" and version "4.5.2"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe