CVE-2020-26668

BigTree CMS 4.4.10 and earlier contains a SQL injection in /core/feeds/custom.php exploitable via the Create New Feed function by an authenticated user. The vulnerability stems from improper handling of input in that endpoint, allowing injection of malicious SQL queries. Reported impact per CVSS:...

Fastspot BigTree SQL注入漏洞

BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier versions. An attacker can exploit this vulnerability to inject malicious SQL queries into the application via the 'Creat...

CVE-2020-26668: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...

CVE-2020-26669: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...

Fastspot BigTree 跨站脚本漏洞

Fastspot BigTree is an open source content management system CMS based on PHP and MySQL from Fastspot Inc. in the United States. A cross-site scripting vulnerability exists in BigTree CMS version 4.4.10 and prior versions that allows an authenticated attacker to update the site's index.php...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

Fastspot BigTree 操作系统命令注入漏洞

BigTree CMS is an open source content management system based on PHP and MySQL. A remote code execution vulnerability exists in BigTree CMS 4.4.10 and earlier versions. The vulnerability can be exploited to execute arbitrary commands by sending a specially crafted request to the server via the...

BigTree CMS Remote Code Execution Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. A remote code execution vulnerability exists in BigTree CMS. An attacker can exploit the vulnerability to execute arbitrary code...

BigTree CMS 4.4.10 Remote Code Execution

Exploit Title: BigTree CMS 4.4.10 - Remote Code Execution Google Dork: " BigTree CMS " Date: 2020-25-09 Exploit Author: SunCSR ThienNV and HoaVT - Sun Cyber Security Research Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/ Version: 4.4.10 Tested on: Windows...

PT-2020-6081

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.4.10 and earlier Description A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS, which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to...

BigTree CMS SQL Injection Vulnerability (CNVD-2019-40510)

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information...

BigTree CMS Deserialization Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS has a deserialization vulnerability that can be exploited by an attacker to gain control of the web server...

Backend SQL Injection in BigTree CMS 4.4.6

We have scanned one of the latest versions of BigTree CMS 4.4.6 and detected multiple vulnerabilities. Among them is a SQL Injection vulnerability and a Phar Deserialization vulnerability leading to a Remote Code Execution in the small web application. The truncated analysis results are available...

Stored Cross-Site Scripting Vulnerability in BigTree CMS

BigTree CMS is an open source content management system based on PHP and MySQL. A stored cross-site scripting vulnerability exists in BigTree CMS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

BigTree CMS 'parent' SQL Injection Vulnerability

BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in BigTree CMS 'parent'. An attacker can exploit the vulnerability to obtain sensitive database information...

BigTree CMS 4.3.4 SQL Injection

=========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Dork: N/A Date: 24-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/download/cor...

BigTree 4.3.4 CMS - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications =========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software Link:...

BigTree 4.3.4 CMS - Multiple SQL Injection

BigTree 4.3.4 CMS - Multiple SQL Injection =========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Dork: N/A Date: 24-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software...

BigTree 4.3.4 CMS - Multiple SQL Injection

=========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Dork: N/A Date: 24-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/download/cor...

Fastspot BigTree Information Disclosure Vulnerability

Fastspot BigTree is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An information disclosure vulnerability exists in the admin/news/ page in Fastspot BigTree version 4.3, which can be exploited by an attacker to obtain path information...