File Upload Bypass in Pluck CMS

Executive Summary

Pluck CMS up to version 4.7.21 uses a fixed blacklist to block dangerous file uploads in its admin file-management feature. The blacklist checks the last 4-5 characters of filenames but misses the .php8 extension. An authenticated admin can upload a file named shell.php8, which is stored unmodified. On servers running PHP 8.x, this file is executed as PHP code by the web server, allowing remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check for files with .php8 extension in your Pluck CMS file upload directories, especially in the admin file-management section. Review server logs for unexpected PHP file executions or uploads from authenticated users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated administrator to upload malicious PHP files with a .php8 extension. If exploited, it can lead to remote code execution on the server, potentially allowing attackers to take full control of the system, steal data, or install malware.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using Pluck CMS may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update Pluck CMS to the latest version if available. Manually add '.php8' to the blacklist in data/inc/files.php. Restrict file upload permissions to trusted administrators only. Monitor for unauthorized file uploads or executions.

Useful 0 Not Useful 0