CVE-2013-4881

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

PT-2013-5258

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.0 RC2 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to "index.php...

CVE-2013-4881

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

PT-2013-5473

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.0 RC2 and earlier Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action...

CVE-2013-5313: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action...

CVE-2013-4881: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

CVE-2013-4881

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php...

CVE-2013-4881

CVE-2013-4881 is a CSRF vulnerability in BigTree CMS 4.0 RC2 and earlier. The issue lies in core/admin/modules/users/create.php, allowing an attacker to hijack an admin’s session and create a new administrative user via requests to index.php. Exploitation demonstrated with a crafted form that sub...

BigTree CMS Multiple Vulnerabilities

BigTree CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bigtreecms:bigtreecms";...

BigTree CMS index.php SQL Injection

The BigTree CMS install hosted on the remote web server fails to sanitize user-supplied input to the application's 'site/index.php' script before using it in a database query. An unauthenticated attacker may be able to exploit this issue to manipulate database queries, leading to disclosure of...

BigTree CMS Detection

The remote web server hosts BigTree CMS, an open source content management system using PHP and MySQL. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69368; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

Cross site scripting

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

CVE-2013-4880

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

CVE-2013-4879

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

Sql injection

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4879

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4880

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

CVE-2013-4879

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4879

Vulnerability: CVE-2013-4879 affects BigTree CMS 4.0 RC2 and earlier, due to an SQL injection in the code path that processes input via PATH_INFO to index.php (affecting core/inc/bigtree/cms.php). The root cause is insufficient sanitization/validation of user-supplied data, enabling remote attack...