CVE-2008-6842

Pluck 4.6.1 - Path Traversal via Post Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2008-6842. PoCs published by Alfons Luja.

AI-analyzed exploit summary This exploit targets a Local File Inclusion (LFI) vulnerability in Pluck CMS 4.6.1, allowing arbitrary file inclusion and command execution via log poisoning. The script injects a PHP payload into Apache logs and triggers it via the LFI vulnerability.

Description

Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Alfons Luja · phpwebappsphp

https://www.exploit-db.com/exploits/8271

View Code ZIP pw:eip

This exploit targets a Local File Inclusion (LFI) vulnerability in Pluck CMS 4.6.1, allowing arbitrary file inclusion and command execution via log poisoning. The script injects a PHP payload into Apache logs and triggers it via the LFI vulnerability.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Pluck CMS 4.6.1

No auth needed

Prerequisites: Target must have Pluck CMS 4.6.1 installed · Apache access logs must be writable · Target must allow remote file inclusion via the vulnerable parameter

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →