Digital Security Research Group have reported two vulnerabilities in Pluck, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "blogpost" and "cat" parameters through index.php to data/inc/blog_include_react.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources.

Successful exploitation requires that the product is running on a Windows server.

The vulnerabilities are reported in version 4.5.2. Prior versions may also be affected.

Solution
Update to version 4.5.3.

Provided and/or discovered by
Digital Security Research Group

Changelog
Further details available in Customer Area

Original Advisory
Pluck:
http://www.pluck-cms.org/releasenotes.php#4.5.3

Digital Security Research Group:
http://milw0rm.com/exploits/6300

Deep Links
Links available in Customer Area