Attack Chain

1. Attacker performs authentication to obtain a valid session cookie for the Pluck CMS administration interface.
2. Attacker navigates to the module installation page at admin.php?action=installmodule.
3. Attacker crafts a ZIP file containing a malicious PHP web shell or payload.
4. Attacker sends an HTTP POST request to the modules_install.php script to upload the crafted ZIP file.
5. The server-side code insecurely extracts the ZIP contents to a directory on the web server.
6. The web server extracts the PHP payload file, potentially into a location accessible to the public web root.
7. Attacker navigates to the URL where the uploaded PHP file is stored.
8. Web server executes the PHP payload, granting the attacker arbitrary code execution on the underlying host.

Impact

Successful exploitation of CVE-2023-50564 results in full remote code execution on the target server. This enables attackers to steal sensitive application data, pivot deeper into the internal network, or deploy additional malware. Given the high CVSS score of 8.8, this flaw poses a critical risk to any infrastructure hosting unpatched versions of Pluck CMS 4.7.18.

Recommendation

• Patch Pluck CMS instances to the latest available version beyond 4.7.18.
• Implement strict access control lists (ACLs) for the admin.php endpoint to prevent unauthorized access by low-privileged users.
• Deploy the provided webserver detection rule to monitor for malicious file upload patterns in application logs.
• Audit the web server's upload directories to identify and remove unauthorized .php or .phtml files.