Arbitrary file upload in Pluck-cms Pluck
CVE-2023-50564
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
Vulnerability class: Unrestricted File Upload
EPSS: 0.291 (97.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Pluck-cms Pluck — versions 4.7.18
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
- Rai2en/CVE-2023-50564_Pluck-v4.7.18_PoC
- thefizzyfish/CVE-2023-50564-pluck
- 0xDTC/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564
- xpltive/CVE-2023-50564
- Mrterrestrial/CVE-2023-50564
- kikechans/-Pluck-CMS-RCE-CVE-2023-50564
- glynzr/CVE-2023-50564
- rwexecute/CVE-2023-50564
- ipuig/CVE-2023-50564
- TanveerS1ngh/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564
References
- cve@mitre.org (Exploit)
Frequently asked questions
- What is CVE-2023-50564?
- CVE-2023-50564 is a high-severity vulnerability in Pluck-cms Pluck, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2023-12-14.
- How severe is CVE-2023-50564?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2023-50564 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.