CVE-2020-26669: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...

CVE-2020-26668: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

BigTree CMS Remote Code Execution Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. A remote code execution vulnerability exists in BigTree CMS. An attacker can exploit the vulnerability to execute arbitrary code...

PT-2020-6081

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.4.10 and earlier Description A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS, which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to...

PT-2020-6082

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.4.10 and earlier Description A SQL injection issue was found in the /core/feeds/custom.php component of BigTree CMS, related to the lack of protection against SQL query structure manipulation. This allows an authenticate...

BigTree CMS 4.4.10 Remote Code Execution

Exploit Title: BigTree CMS 4.4.10 - Remote Code Execution Google Dork: " BigTree CMS " Date: 2020-25-09 Exploit Author: SunCSR ThienNV and HoaVT - Sun Cyber Security Research Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/ Version: 4.4.10 Tested on: Windows...

BigTree CMS Deserialization Vulnerability

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS has a deserialization vulnerability that can be exploited by an attacker to gain control of the web server...

BigTree CMS SQL Injection Vulnerability (CNVD-2019-40510)

BigTree CMS is a small open source cms based on PHP and Mysql. BigTree CMS suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information...

Backend SQL Injection in BigTree CMS 4.4.6

We have scanned one of the latest versions of BigTree CMS 4.4.6 and detected multiple vulnerabilities. Among them is a SQL Injection vulnerability and a Phar Deserialization vulnerability leading to a Remote Code Execution in the small web application. The truncated analysis results are available...

Stored Cross-Site Scripting Vulnerability in BigTree CMS

BigTree CMS is an open source content management system based on PHP and MySQL. A stored cross-site scripting vulnerability exists in BigTree CMS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

BigTree CMS 'parent' SQL Injection Vulnerability

BigTree CMS is an open source content management system based on PHP and MySQL. A SQL injection vulnerability exists in BigTree CMS 'parent'. An attacker can exploit the vulnerability to obtain sensitive database information...

BigTree CMS 4.3.4 SQL Injection

=========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Dork: N/A Date: 24-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/download/cor...

BigTree 4.3.4 CMS - Multiple SQL Injection Vulnerabilities

Exploit for php platform in category web applications =========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software Link:...

BigTree 4.3.4 CMS - Multiple SQL Injection

BigTree 4.3.4 CMS - Multiple SQL Injection =========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Dork: N/A Date: 24-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software...

BigTree 4.3.4 CMS - Multiple SQL Injection

=========================================================================================== Exploit Title: BigTree CMS - 'parent' SQL Inj. Dork: N/A Date: 24-03-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.bigtreecms.org/ Software Link: https://www.bigtreecms.org/download/cor...

CVE-2018-20405

BigTree 4.3 allows full path disclosure via authenticated admin/news/ input that triggers a syntax error. NOTE: This has been disputed with the following reasoning: "The issue reported requires full developer level access to the content management system where cross site scripting is not an issue...

BigTree CMS 4.2.23 - Cross-Site Scripting

BigTree CMS 4.2.23 - Cross-Site Scripting Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Date: 2018-10-15 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23...

BigTree CMS 4.2.23 - Cross-Site Scripting

Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Date: 2018-10-15 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23 Vulernability Type : Cross-site Scripting...

BigTree CMS 4.2.23 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23...