CVE-2020-26670

CVE-2020-26670 affects BigTree CMS up to version 4.4.10. An authenticated attacker can execute arbitrary commands through a crafted request to the server via the Create a New Setting (also described as Create New Setup in some sources) function. The root cause is a command execution vulnerability...

CVE-2020-26669

A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...

CVE-2020-26669

BigTree CMS 4.4.10 and earlier is affected by a stored XSS in the admin pages update path (site/index.php/admin/pages/update). The issue allows an authenticated attacker to inject and execute arbitrary web scripts/HTML via page content. Impact is limited to confidentiality/ integrity depending on...

CVE-2020-26668

A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...

CVE-2020-26668

BigTree CMS 4.4.10 and earlier contains a SQL injection in /core/feeds/custom.php exploitable via the Create New Feed function by an authenticated user. The vulnerability stems from improper handling of input in that endpoint, allowing injection of malicious SQL queries. Reported impact per CVSS:...

Fastspot BigTree 操作系统命令注入漏洞

BigTree CMS is an open source content management system based on PHP and MySQL. A remote code execution vulnerability exists in BigTree CMS 4.4.10 and earlier versions. The vulnerability can be exploited to execute arbitrary commands by sending a specially crafted request to the server via the...

Fastspot BigTree 跨站脚本漏洞

Fastspot BigTree is an open source content management system CMS based on PHP and MySQL from Fastspot Inc. in the United States. A cross-site scripting vulnerability exists in BigTree CMS version 4.4.10 and prior versions that allows an authenticated attacker to update the site's index.php...

Fastspot BigTree SQL注入漏洞

BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier versions. An attacker can exploit this vulnerability to inject malicious SQL queries into the application via the 'Creat...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

CVE-2020-26669: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...

CVE-2020-26668: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...

PT-2021-11256

Name of the Vulnerable Software and Affected Versions: BigTree CMS versions 4.4.10 and earlier Description: A vulnerability has been discovered that allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

BigTree CMS Remote Code Execution Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. A remote code execution vulnerability exists in BigTree CMS. An attacker can exploit the vulnerability to execute arbitrary code...

BigTree CMS 4.4.10 Remote Code Execution

Exploit Title: BigTree CMS 4.4.10 - Remote Code Execution Google Dork: " BigTree CMS " Date: 2020-25-09 Exploit Author: SunCSR ThienNV and HoaVT - Sun Cyber Security Research Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/ Version: 4.4.10 Tested on: Windows...

PT-2020-6082

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.4.10 and earlier Description A SQL injection issue was found in the /core/feeds/custom.php component of BigTree CMS, related to the lack of protection against SQL query structure manipulation. This allows an authenticate...

PT-2020-6081

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.4.10 and earlier Description A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS, which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to...

BigTree CMS SQL Injection Vulnerability (CNVD-2019-40510)

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information...

BigTree CMS Deserialization Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS has a deserialization vulnerability that can be exploited by an attacker to gain control of the web server...

Backend SQL Injection in BigTree CMS 4.4.6

We have scanned one of the latest versions of BigTree CMS 4.4.6 and detected multiple vulnerabilities. Among them is a SQL Injection vulnerability and a Phar Deserialization vulnerability leading to a Remote Code Execution in the small web application. The truncated analysis results are available...

Stored Cross-Site Scripting Vulnerability in BigTree CMS

BigTree CMS is an open source content management system based on PHP and MySQL. A stored cross-site scripting vulnerability exists in BigTree CMS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...