CVE-2016-10223

CVE-2016-10223 – BigTree CMS XSS in id parameter . Affected software: BigTree CMS prior to 4.2.15. The vulnerability stems from insufficient filtration of user-supplied data in the GET parameter id passed to core/admin/adjax/dashboard/check-module-integrity.php, allowing an attacker to inject arb...

CVE-2016-10223: Improper Access Control

An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in...

PT-2017-7820

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.15 Description The issue is caused by insufficient filtration of user-supplied data in the id HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" API endpoint. This allows ...

BigTree CMS 'check-module-integrity.php' Cross-Site Scripting Vulnerability

BigTree CMS is an open source content management system. A cross-site scripting vulnerability exists in BigTree CMS 'check-module-integrity.php'. An attacker could exploit the vulnerability to execute arbitrary script code in a user's browser while browsing the affected site to steal cookie-based...

BigTree CMS 'redraw-field.php' Cross-Site Scripting Vulnerability

BigTree CMS is an open source content management system. A cross-site scripting vulnerability exists in BigTree CMS 'redraw-field.php'. An attacker could exploit the vulnerability to execute arbitrary script code in a user's browser while browsing the affected site to steal cookie-based...

BigTree CMS SQL Injection Vulnerability

BigTree CMS is the United States Fastspot company based on PHP and MySQL open source content management system CMS. A SQL injection vulnerability exists in versions of Bigtree Cms prior to 4.1.16, which stems from the program failing to adequately filter user-submitted input. An attacker can...

BigTree CMS 4.2.13 Cross Site Request Forgery

-------------------------- - Exploit Title : bigtree cms CSRF Exploit - Author : Ashiyane Digital Security Team - Vendor Homepage: https://www.bigtreecms.org/ - Software Link: - https://www.bigtreecms.org/ajax/download-installer/?installer=53 - Version : 4.2.13 - Date: 26-10-2016 - Tested On :...

BigTree-CMS 4.1.x < 4.1.9 XSS

Binary data 9553.prm...

BigTree-CMS 4.2.x < 4.2.3 XSS

Binary data 9554.prm...

BigTree-CMS 4.2.x < 4.2.9 Multiple Vulnerabilities

Binary data 9556.prm...

BigTree-CMS 4.2.x < 4.2.4 Multiple Vulnerabilities

Binary data 9555.prm...

BigTree CMS 4.2.11 SQL Injection

ADVISORY INFORMATION ======================================== Title: BigTree CMS substr$page,1; else // It's an existing page $type = "EDIT"; $pending = false; $existingpage = BigTreeCMS::getPage$page; $existingpendingchange = sqlfetchsqlquery"SELECT id FROM bigtreependingchanges WHERE table =...

BigTree CMS 4.2.11 - SQL Injection

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================================== Title: BigTree CMS substr$page,1; else // It's an existing page $type = "EDIT"; $pending = false; $existingpage = BigTreeCMS::getPage$page; $existingpendingchange =...

BigTree CMS 4.2.11 - SQL Injection

BigTree CMS 4.2.11 - SQL Injection 1. ADVISORY INFORMATION ======================================== Title: BigTree CMS substr$page,1; else // It's an existing page $type = "EDIT"; $pending = false; $existingpage = BigTreeCMS::getPage$page; $existingpendingchange = sqlfetchsqlquery"SELECT id FROM...

BigTree CMS 4.2.11 - SQL Injection

ADVISORY INFORMATION ======================================== Title: BigTree CMS substr$page,1; else // It's an existing page $type = "EDIT"; $pending = false; $existingpage = BigTreeCMS::getPage$page; $existingpendingchange = sqlfetchsqlquery"SELECT id FROM bigtreependingchanges WHERE table =...

BigTree 4.2.8 Object Injection / Improper Filename Sanitization

Security Advisory - Curesec Research Team 1. Introduction Affected Product: BigTree 4.2.8 Fixed in: BigTree 4.2.9 Fixed Version Link: https://www.bigtreecms.org/download/ Vendor Website: https://www.bigtreecms.org/ Vulnerability Type: Object Injection & Improper Filename Sanitation Remote...

BigTree CMS 4.2.3 - Authenticated SQL Injection Vulnerabilities

Exploit for php platform in category web applications BigTree CMS 4.2.3: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team Online-Reference: http://blog.curesec.com/article/blog/BigTree-CMS-423-Multiple-SQL-Injection-Vulnerabilities-39.html 1. Introduction Affected...

BigTree CMS 4.2.3 - (Authenticated) SQL Injection

BigTree CMS 4.2.3 - Authenticated SQL Injection BigTree CMS 4.2.3: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team Online-Reference: http://blog.curesec.com/article/blog/BigTree-CMS-423-Multiple-SQL-Injection-Vulnerabilities-39.html 1. Introduction Affected Produc...

BigTree CMS 4.2.3 - (Authenticated) SQL Injection

BigTree CMS 4.2.3: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team Online-Reference: http://blog.curesec.com/article/blog/BigTree-CMS-423-Multiple-SQL-Injection-Vulnerabilities-39.html 1. Introduction Affected Product: BigTree CMS 4.2.3 Fixed in: 4.2.4 Fixed Versi...

Fastspot BigTree has multiple vulnerabilities

Fastspot BigTree is a PHP and MySQL based open source content management system . SQL injection vulnerabilities and cross-site scripting vulnerabilities exist in Fastspot BigTree, which can be exploited by an attacker to steal cookie-based authentication or to control the application, access or...