PT-2017-18928

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by creating a crafted table name at the "admin/developer/modules/views/create/" endpoint and the...

Fastspot BigTree CMS Unauthorized Operation Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An unauthorized operation vulnerability exists in Fastspot BigTree CMS version 4.2.18 and earlier, which stems from the program failing to prevent a user from deleting thei...

Fastspot BigTree CMS SQL Injection Vulnerability (CNVD-2017-08541)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in Fastspot BigTree CMS version 4.2.18 and earlier. The vulnerability can be exploited by remote attackers to execute arbitrary SQL...

Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-08540)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS version 4.2.18 and earlier. A remote attacker can exploit this vulnerability to perform unauthoriz...

CVE-2017-9449: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible ...

Cross site scripting

DISPUTED Multiple cross-site scripting XSS vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the 1 title or 2 version or 3 authorname parameter in manifest.json. This issu...

Cross site request forgery (csrf)

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

CVE-2017-9441

Multiple cross-site scripting XSS vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the 1 title or 2 version or 3 authorname parameter in manifest.json. This issue exists ...

CVE-2017-9444

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

CVE-2017-9443

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

CVE-2017-9442

BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in...

Design/Logic Flaw

DISPUTED BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in...

Sql injection

DISPUTED BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

CVE-2017-9443

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

CVE-2017-9442

BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in...

CVE-2017-9444

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

CVE-2017-9441

Multiple cross-site scripting XSS vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or HTML by uploading a crafted package, triggering mishandling of the 1 title or 2 version or 3 authorname parameter in manifest.json. This issue exists ...

CVE-2017-9444

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

CVE-2017-9443

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and...

CVE-2017-9443

BigTree CMS before or at version 4.2.18 is affected by CVE-2017-9443. The vulnerability arises from an SQL injection via a crafted tables object in manifest.json in an uploaded package, affecting core/admin/modules/developer/extensions/install/process.php and core/admin/modules/developer/packages...