CVE-2023-25828 describes an authenticated remote code execution (RCE) vulnerability in Pluck CMS, specifically within its "albums" module. This flaw allows an authenticated attacker to upload a specially crafted JPEG file containing a PHP web-shell due to insufficient file extension validation. The vulnerability carries a CVSS score of 7.2 (High), indicating that an attacker with administrator credentials can achieve full compromise of the underlying web server, leading to high impact on confidentiality, integrity, and availability. While the vulnerability requires high privileges (PR:H), its network-based attack vector (AV:N) and low attack complexity (AC:L) make it a significant risk. There is no evidence of active exploitation, and public exploit code (Metasploit, Nuclei, ExploitDB) is currently unavailable, though there is some community discussion on Reddit.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.7.16CPE matchmatch criteria | cpe:2.3:a:pluck-cms:pluck:*:*:*:*:*:*:*:* | ||
4.7.16CPE matchmatch criteria | cpe:2.3:a:pluck-cms:pluck:4.7.16:dev1:*:*:*:*:*:* | ||
4.7.16CPE matchmatch criteria | cpe:2.3:a:pluck-cms:pluck:4.7.16:dev2:*:*:*:*:*:* | ||
4.7.16CPE matchmatch criteria | cpe:2.3:a:pluck-cms:pluck:4.7.16:dev3:*:*:*:*:*:* | ||
4.7.16CPE matchmatch criteria | cpe:2.3:a:pluck-cms:pluck:4.7.16:dev4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.