CVE:CVE-2008-6842
CNNVD:CNNVD-200907-027
pluck是用php编写的简单内容管理系统 。
pluck的\data\modules\blog\module_pages_site.php模块中没有正确地过滤用户所提交的请求参数：
...
$includepage = 'blog_include.php'; //Only set 'view post'-page if a post has been specified 
if (isset($_GET['post'])) { //Check if post exists， and include information 
if (file_exists('data/settings/modules/blog/posts/'.$_GET['post'])) { include('data/settings/modules/blog/posts/'.$_GET['post']); 
$module_page['viewpost'] = $post_title; } }
...
远程攻击者可以通过向服务器提交特制的HTTP POST请求包含任意本地资源，导致执行任意代码 。
solution:Upgrade pluck-cms pluck to a higher version than 4.6.1,and avoid the version 4.6.1