Pluck CMS: module RCE (CVE-2023-50564)

Pluck CMS is a database-less PHP content manager. Its admin panel lets you install modules by uploading a .zip file. CVE-2023-50564 (affecting version 4.7.18 and earlier) is an arbitrary file upload: the installer unzips the archive into the modules directory without validating its contents, so any .php we put inside ends up on a path served by the web server and can be executed. It's a concrete case of the upload-to-RCE pattern, made worse because the legitimate feature itself (installing modules) is the vector.

It requires being authenticated as admin, so you first need those credentials (in GreenHorn, by cracking a hash leaked in a Gitea repo). With an admin session, the flow is direct: pack a PHP webshell into a ZIP and upload it through the module installer.

zip shell.zip shell.php
# admin.php?action=installmodule  →  upload shell.zip
curl 'http://greenhorn.htb/data/modules/shell/shell.php?cmd=id'

After the upload, the panel confirms "module installed successfully" and the .php is reachable under data/modules/. Pointing a reverse shell at it yields execution as the web server user (www-data).

How to detect it. The chain is visible in the log: an administrator login followed by a POST to admin.php?action=installmodule uploading a .zip, and right after the appearance of a new .php under data/modules/ (a FIM on that directory catches it instantly). Later execution shows as a request to data/modules/<x>/<x>.php?cmd= returning command output, and as the web process (www-data) spawning sh/bash as a child. An installed module containing code instead of a legitimate module's files is the signature.

Defence. Validate the contents of uploaded packages (extension allow-list, don't extract executable .php to served paths), isolate the modules directory from PHP execution, and keep the CMS up to date.