Remote Code Execution via Image Upload in Pluck CMS
CVE-2018-11736

9.8CRITICAL

Key Information:

Vendor

Pluck-cms

Status
Pluck
Vendor
CVE Published:
5 June 2018

What is CVE-2018-11736?

An issue in Pluck CMS prior to version 4.7.7-dev2 enables remote attackers to upload and execute arbitrary PHP code by exploiting the incorrect handling of .htaccess files disguised as image/jpeg content. This vulnerability poses significant security risks, allowing unauthorized access and execution of malicious scripts on the server.

References

https://github.com/pluck-cms/pluck/issues/61
x_refsource_CONFIRM
https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2
x_refsource_CONFIRM

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

JSON
.
CVE-2018-11736 : Remote Code Execution via Image Upload in Pluck CMS