caelumisme/cve-2020-29607-pocPython 3 exploit for Pluck CMS 4.7.13 file upload restriction bypass, enabling authenticated admin to upload a PHP webshell and achieve remote code execution.
Author: Ron Jost (Hacker5preme)
Reference: Exploit-DB
CVE: CVE-2020-29607
⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool.
This is a Python 3 exploit script for the File Upload Restriction Bypass vulnerability in Pluck CMS 4.7.13. It allows an authenticated admin user to upload a malicious file (webshell) and achieve remote code execution on the target server.
python pluck_exploit.py <target_ip> <target_port> <admin_password> <pluckcms_path>
python pluck_exploit.py 10.10.10.100 80 admin /pluck
requests libraryInstall dependencies with:
pip install requests
.phar webshell using the file manager bypassThe script provides clear, step-by-step output for authentication, upload status, and webshell access.
This script is a great way to learn about file upload bypasses and remote code execution. Use it responsibly, and always with permission!
This project is for educational use only. No warranty, no guarantees. Hack ethically, stay curious!