high7.2Public exploit code
CVE-2020-29607
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files"…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)2021-05-26 · webapps · php · Verified
Impact
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pluck-Cms | Pluck | before 4.7.13 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/162785/Pluck-CMS-4.7.13-Remote-Shell-Upload.html
- https://github.com/Hacker5preme/Exploits/tree/main/CVE-2020-29607-Exploit
- https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-29607.md
- https://github.com/pluck-cms/pluck/issues/96
- http://packetstormsecurity.com/files/162785/Pluck-CMS-4.7.13-Remote-Shell-Upload.html
- https://github.com/Hacker5preme/Exploits/tree/main/CVE-2020-29607-Exploit
- https://github.com/pluck-cms/pluck/issues/96