Pluck 'g_pcltar_lib_dir' Parameter Local File Include Vulnerability

Bugtraq ID:	32342
Class:	Input Validation Error
CVE:	CVE-2008-6253
Remote:	Yes
Local:	No
Published:	Nov 18 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	Digital Security Research Group
Vulnerable:	Pluck Pluck 4.5.3
Not Vulnerable:	Pluck Pluck 4.6

Pluck 'g_pcltar_lib_dir' Parameter Local File Include Vulnerability

Pluck is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Pluck 4.5.3 is vulnerable; other versions may also be affected.

Pluck 'g_pcltar_lib_dir' Parameter Local File Include Vulnerability

Attackers can exploit this issue via a browser.

Pluck 'g_pcltar_lib_dir' Parameter Local File Include Vulnerability

Solution:
Reportedly, the vendor released updates to address this issue but Symantec was unable to confirm this information. Please see the references for more information.

Pluck 'g_pcltar_lib_dir' Parameter Local File Include Vulnerability

References:

• Pluck Homepage (Pluck)
  
• [DSECRG-08-039] Local File Include Vulnerability in Pluck CMS 4.5.3] (Digital Security Research Group )