Pluck CMS Installation install.php cross site scripting

Successful exploitation of CVE-2023-5013 allows an attacker to inject arbitrary JavaScript code into the Pluck CMS application. This can lead to a variety of malicious actions, including stealing user cookies, redirecting users to phishing sites, or defacing the website. The attack is remotely exploitable, meaning an attacker does not need to be on the same network as the CMS. While the complexity of the attack is considered high, the public disclosure of the vulnerability increases the risk of exploitation, particularly if users have not yet applied the patch.

Websites and applications using Pluck CMS version 4.7.18 are at risk. Shared hosting environments where multiple websites share the same instance of Pluck CMS are particularly vulnerable, as an attacker could potentially compromise other websites on the same server.

• php: Examine install.php for unsanitized input handling of the contents parameter. Search for instances where user-supplied data is directly injected into HTML output without proper encoding.

// Example: Check for suspicious characters in the contents parameter
if (preg_match('/<script>/i', $_GET['contents'])) {
  // Log or block the request
}

• generic web: Monitor access logs for requests to install.php containing suspicious payloads (e.g., <script>, javascript:, onerror=). • generic web: Check response headers for signs of injected JavaScript code (e.g., unusual Content-Security-Policy directives).

1. 2023-09-16Disclosure

   disclosure

1. Gereserveerd2023-09-16
2. Gepubliceerd2023-09-16
3. Gewijzigd2024-08-02
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2023-5013 is to upgrade Pluck CMS to version 4.7.19 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the contents parameter in install.php to prevent the injection of malicious scripts. While a Web Application Firewall (WAF) might offer some protection, it is not a substitute for patching the vulnerable software. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into the contents parameter of install.php and confirming that it is properly sanitized.