Pluck CMS 4.7 - Multiple Local File Inclusion / File Disclosure Vulnerabilities

source: https://www.securityfocus.com/bid/49525/info Pluck is prone to multiple file-include and a file-disclosure vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view an...

Pluck 4.7 multiple vulnerabilities

Exploit for php platform in category web applications Exploit Title: Pluck 4.7 multiple vulnerabilities Google Dork: Powered by pluck Date: 05/08/2011 Author: Bl4k3 Software Link: http://www.pluck-cms.org/?file=download Version: 4.7 Tested on: Debian CVE : / 1-File Inclusion:...

Pluck CMS Cross Site Request Forgery Exploit

Exploit for php platform in category web applications +Exploit Title: Pluck CMS Cross Site Request Forgery Exploit +Author : ^Xecuti0n3r + Date : 22.04.2011 + Hour : 13:37 PM + E-mail : xecuti0n3ryahoo.com +download: http://www.pluck-cms.org/?file=kop2.php + Category : Web Apps XSRF Pluck CMS Cro...

Pluck CMS Cross Site Request Forgery

+Exploit Title: Pluck CMS Cross Site Request Forgery Exploit +Author : ^Xecuti0n3r + Date : 22.04.2011 + Hour : 13:37 PM + E-mail : xecuti0n3ryahoo.com +download: http://www.pluck-cms.org/?file=kop2.php + Category : Web Apps XSRF Pluck CMS Cross Site Request Forgery Exploit var pauses = new Array...

Pluck CMS 4.6.4 Path Disclosure

Vulnerability ID: HTB22799 Reference: http://www.htbridge.ch/advisory/pathdisclosureinpluckcms1.html Product: Pluck Vendor: Pluck CMS http://www.pluck-cms.org Vulnerable Version: 4.6.4 Vendor Notification: 18 January 2011 Vulnerability Type: Path disclosure Risk level: Low Credit: High-Tech Bridg...

HTB22798: Path disclosure in Pluck CMS

Vulnerability ID: HTB22798 Reference: http://www.htbridge.ch/advisory/pathdisclosureinpluckcms.html Product: Pluck Vendor: Pluck CMS http://www.pluck-cms.org Vulnerable Version: 4.6.4 Vendor Notification: 18 January 2011 Vulnerability Type: Path disclosure Risk level: Low Credit: High-Tech Bridge...

HTB22799: Path disclosure in Pluck CMS

Vulnerability ID: HTB22799 Reference: http://www.htbridge.ch/advisory/pathdisclosureinpluckcms1.html Product: Pluck Vendor: Pluck CMS http://www.pluck-cms.org Vulnerable Version: 4.6.4 Vendor Notification: 18 January 2011 Vulnerability Type: Path disclosure Risk level: Low Credit: High-Tech Bridg...

Installation Path Disclosure Weakness in Pluck CMS

High-Tech Bridge SA Security Research Lab has discovered a weakness in Pluck CMS which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in Pluck CMS The weakness exists due to application reveals the full path to installation director...

Pluck 4.6.3 Cross Site Scripting

Vulnerability ID: HTB22610 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluck.html Product: Pluck Vendor: Pluck Team http://www.pluck-cms.org Vulnerable Version: 4.6.3 and probably prior versions Vendor Notification: 15 September 2010 Vulnerability Type: XSS Cross Site Scripting...

Pluck CMS 4.6.3 - cont1 HTML Injection

Pluck CMS 4.6.3 - cont1 HTML Injection source: https://www.securityfocus.com/bid/43597/info Pluck is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplie...

XSS vulnerability in Pluck

Vulnerability ID: HTB22610 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinpluck.html Product: Pluck Vendor: Pluck Team http://www.pluck-cms.org Vulnerable Version: 4.6.3 and probably prior versions Vendor Notification: 15 September 2010 Vulnerability Type: XSS Cross Site Scripting...

Pluck CMS 4.6.3 - 'cont1' HTML Injection

source: https://www.securityfocus.com/bid/43597/info Pluck is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Successful exploits will allow attacker-supplied HTML and script code to run in the...

Cross-site Scripting (XSS) Vulnerability in Pluck

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Pluck which could be exploited to perform cross-site scripting attacks. 1 Cross-site scripting XSS vulnerability in Pluck The vulnerability exists due to input sanitation error in the "cont1" parameter in...

Directory traversal

Directory traversal vulnerability in data/modules/blog/modulepagessite.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the post parameter...

CVE-2008-6842

Directory traversal vulnerability in data/modules/blog/modulepagessite.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the post parameter...

CVE-2008-6842

CVE-2008-6842 affects Pluck 4.6.1, specifically the file data/modules/blog/module_pages_site.php. The vulnerability is a directory traversal in the post parameter (..), allowing remote attackers to include and execute arbitrary local files. The available sources confirm the affected software and ...

CVE-2008-6842

Directory traversal vulnerability in data/modules/blog/modulepagessite.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the post parameter...

Directory traversal

Multiple directory traversal vulnerabilities in pluck 4.6.2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langpref parameter to 1 data/modules/contactform/moduleinfo.php, 2 data/modules/blog/moduleinfo.php, and 3...

CVE-2009-1765

Multiple directory traversal vulnerabilities in pluck 4.6.2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via a .. dot dot in the langpref parameter to 1 data/modules/contactform/moduleinfo.php, 2 data/modules/blog/moduleinfo.php, and 3...

Immunity Canvas: PLUCK_LFI

Name| plucklfi ---|--- CVE| CVE-2009-1765 Exploit Pack| CANVAS Description| Pluck 4.6.2 Local File Include Notes| CVE Name: CVE-2009-1765 VENDOR: Pluck Repeatability: Infinite CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-1765 References: 'http://www.milw0rm.com/exploits/8715' CVSS:...