CVE-2017-9365

CVE-2017-9365 describes a CSRF vulnerability in BigTree CMS up to version 4.2.18. The issue stems from the force parameter to the admin/pages/revisions.php endpoint (for example, /admin/pages/revisions/1/?force=false), which can allow unlocking of a page with id=1. The NVD description confirms CS...

CVE-2017-9364

Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code...

CVE-2017-9364

BigTree CMS < = 4.2.18 is affected by an unrestricted file upload vulnerability that allows an attacker to upload a .pht/.phtml file to bypass a safety check and execute code. Connected sources also reference additional issues in the same release family (BigTree CMS

BigTree CMS - Bypass CSRF filter and execute code with PHPMailer

DESCRIPTION PHPMailer RCE CVE-2016-10033 An independent research uncovered a critical vulnerability in PHPMailer version Sender According to my analysis, if we can control the value of Sender, we can let sendmail save the context to any given path /var/www/html/shell.php, which means code...

BigTree CMS <= 4.2.17 CSRF Vulnerability

BigTree CMS is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

BigTree CMS < 4.2.17 Unrestricted File Upload Vulnerability

BigTree CMS is prone to an unrestricted file upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-7881

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

Cross site request forgery (csrf)

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS

Fastspot BigTree CMS Arbitrary File Upload Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. An arbitrary file upload vulnerability exists in Fastspot BigTree CMS versions prior to 4.2.17. An attacker can bypass security checks and execute arbitrary code by uploadi...

Unrestricted file upload

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...

CVE-2017-7695

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...

CVE-2017-7695

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...

CVE-2017-7695

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.phpspace' file, they could bypass a safety check and execute any code...

CVE-2017-7695

BigTree CMS

Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-03387)

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS version 4.1.18. An attacker can exploit this vulnerability to perform unauthorized operations with...

Fastspot BigTree CMS Cross-Site Request Forgery Vulnerability

Fastspot BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in Fastspot BigTree CMS version 4.2.16. An attacker can exploit this vulnerability to perform unauthorized operations...

BigTree CMS Multiple CSRF Vulnerabilities

BigTree CMS is prone to multiple CSRF vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bigtreecms:bigtreecms";...