CVE-2013-4880

CVE-2013-4880 is an XSS vulnerability affecting BigTree CMS 4.0 RC2 and earlier, in core/admin/modules/developer/modules/views/add.php where the module parameter is unsafely handled. The issue allows a remote attacker to inject arbitrary HTML/script by crafting a link such as /site/index.php/admi...

CVE-2013-4880

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

PT-2013-5256

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.0 RC2 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the PATH INFO to index.php in the core/inc/bigtree/cms.php file. Recommendations For BigTr...

CVE-2013-4879: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATHINFO to index.php...

CVE-2013-4880: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

PT-2013-5257

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.0 RC2 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the module parameter in the /core/admin/modules/developer/modules/views/add.php endpoint...

BigTree CMS 4.0 RC2 XSS / CSRF / SQL Injection

Advisory ID: HTB23165 Product: BigTree CMS Vendor: BigTree CMS Vulnerable Versions: 4.0 RC2 and probably prior Tested Version: 4.0 RC2 Vendor Notification: July 17, 2013 Vendor Patch: July 17, 2013 Public Disclosure: August 7, 2013 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting...

BigTree CMS 4.0 RC2 - Multiple Vulnerabilities

BigTree CMS 4.0 RC2 - Multiple Vulnerabilities Advisory ID: HTB23165 Product: BigTree CMS Vendor: BigTree CMS Vulnerable Versions: 4.0 RC2 and probably prior Tested Version: 4.0 RC2 Vendor Notification: July 17, 2013 Vendor Patch: July 17, 2013 Public Disclosure: August 7, 2013 Vulnerability Type...

BigTree CMS 4.0 RC2 - Multiple Vulnerabilities

Advisory ID: HTB23165 Product: BigTree CMS Vendor: BigTree CMS Vulnerable Versions: 4.0 RC2 and probably prior Tested Version: 4.0 RC2 Vendor Notification: July 17, 2013 Vendor Patch: July 17, 2013 Public Disclosure: August 7, 2013 Vulnerability Type: SQL Injection CWE-89, Cross-Site Scripting...

Multiple Vulnerabilities in BigTree CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in BigTree CMS, which can be exploited to perform SQL injection, Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF attacks. A remote attacker can add, modify or delete information in application's database and...

BigTree CMS Cross Site Request Forgery Vulnerability

BigTree CMS Cross Site Request Forgery Vulnerability. CVE-2013-4881. Webapps exploit for php platform source: http://www.securityfocus.com/bid/61702/info BigTree CMS is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain...