Sql injection

2017-11-2710:29:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.3%

JSON

A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a crafted _tags[] parameter that is mishandled in a later admin/ajax/dashboard/approve-change request.

CPENameOperatorVersion
bigtree_cmsle4.2.19

CPE	Name	Operator	Version
	bigtree_cms	le	4.2.19

References

github.com/bigtreecms/BigTree-CMS/issues/323