CVE-2008-6253

Pluck 4.5.3 - Remote Code Execution via g_pcltar_lib_dir Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6253. PoCs published by DSecRG.

AI-analyzed exploit summary The advisory describes a Local File Include (LFI) vulnerability in Pluck CMS 4.5.3, where the script `data/inc/lib/pcltar.lib.php` allows arbitrary file inclusion via the `g_pcltar_lib_dir` parameter when `register_globals` is enabled. The example provided demonstrates path traversal to read `/etc/passwd`.

Description

Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter.

Exploits (1)

exploitdb WRITEUP VERIFIED

by DSecRG · textwebappsphp

https://www.exploit-db.com/exploits/7153

View Code ZIP pw:eip

The advisory describes a Local File Include (LFI) vulnerability in Pluck CMS 4.5.3, where the script `data/inc/lib/pcltar.lib.php` allows arbitrary file inclusion via the `g_pcltar_lib_dir` parameter when `register_globals` is enabled. The example provided demonstrates path traversal to read `/etc/passwd`.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Pluck CMS 4.5.3

No auth needed

Prerequisites: register_globals enabled

devstral-2 · analyzed Feb 16, 2026 Full analysis →