Beware: Pluck 4.7.7-dev2 Falls for the Oldest Trick in the Book – Code Execution Vulnerability
Pluck 4.7.7-dev2 lets you run PHP code like a secret agent in disguise. Just upload a ‘.htaccess’ file masquerading as an image, and voilà, you’re executing code with a .jpg extension. Who knew JPEGs could moonlight as secret operatives?
Hot Take:
In a shocking twist, the beloved Pluck CMS has been caught with its digital pants down! It seems like the developers forgot to pluck out a pesky little vulnerability. Who knew that uploading a photo could turn into a hacker’s dream vacation? Now, instead of managing images, you might be managing a cybersecurity crisis! Time to update that resume from “Admin” to “Cybersecurity Warrior.”
Key Points:
- Pluck CMS version 4.7.7-dev2 is vulnerable to PHP code execution.
- This vulnerability is due to improper handling of image uploads.
- An attacker can execute arbitrary PHP code by uploading a malicious file.
- The exploit involves manipulating the ‘.htaccess’ file.
- Tested on both Ubuntu and Windows platforms.
Already a member? Log in here