CVE-2017-9365

CVE-2017-9365 describes a CSRF vulnerability in BigTree CMS up to version 4.2.18. The issue stems from the force parameter to the admin/pages/revisions.php endpoint (for example, /admin/pages/revisions/1/?force=false), which can allow unlocking of a page with id=1. The NVD description confirms CS...

CVE-2017-9365

CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked...

CVE-2017-9365

CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked...

CVE-2017-9364

Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code...

PT-2017-18888

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue allows a user to delete their own account, which is supposed to be an admin-only action. This could have security implications as the admin may have other tasks to complete before a us...

CVE-2017-9378: Incorrect Authorization

BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks such as data backups to complete before a user is deleted...

PT-2017-18875

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue allows an attacker to bypass a safety check by uploading files with specific extensions, such as 'xxx.pht' or 'xxx.phtml', potentially leading to code execution. Recommendations For...

PT-2017-18889

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue concerns multiple CSRF problems. Specifically, the clear parameter to "core/admin/modules/dashboard/vitals-statistics/404/clear.php" and the from or to parameters to...

CVE-2017-9379: Cross-Site Request Forgery (CSRF)

Multiple CSRF issues exist in BigTree CMS through 4.2.18 - the clear parameter to core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameter to core\admin\modules\dashboard\vitals-statistics\404\create-301.php...

PT-2017-18876

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue exists due to a CSRF flaw. It can be exploited through the "force" parameter to the "/admin/pages/revisions.php" API endpoint, such as "/admin/pages/revisions/1/?force=false", allowing...

CVE-2017-9365: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked...

CVE-2017-9364: Unrestricted Upload of File with Dangerous Type

Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code...

BigTree CMS - Bypass CSRF filter and execute code with PHPMailer

DESCRIPTION PHPMailer RCE CVE-2016-10033 An independent research uncovered a critical vulnerability in PHPMailer version Sender According to my analysis, if we can control the value of Sender, we can let sendmail save the context to any given path /var/www/html/shell.php, which means code...

BigTree CMS <= 4.2.17 CSRF Vulnerability

BigTree CMS is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

BigTree CMS < 4.2.17 Unrestricted File Upload Vulnerability

BigTree CMS is prone to an unrestricted file upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site request forgery (csrf)

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an HTTP Referer header. This was found in core/admin/modules/developer/header.php and patched in...

CVE-2017-7881

BigTree CMS