CVE-2008-3194

pluck 4.5.1 - Path Traversal via langpref file blogpost or cat Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-3194. PoCs published by BugReport.IR.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Pluck CMS 4.5.1. The vulnerability arises from improper input validation in predefined_variables.php, allowing arbitrary file inclusion via the blogpost parameter.

Description

Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) langpref, (2) file, (3) blogpost, or (4) cat parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by BugReport.IR · textwebappsphp

https://www.exploit-db.com/exploits/6074

View Code ZIP pw:eip

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Pluck CMS 4.5.1. The vulnerability arises from improper input validation in predefined_variables.php, allowing arbitrary file inclusion via the blogpost parameter.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Pluck CMS 4.5.1

No auth needed

Prerequisites: Target running Pluck CMS 4.5.1 or prior · Access to predefined_variables.php

MITRE ATT&CK