PT-2017-14664 · Bigtree · Bigtree Cms

Xcold · Publicado 2017-11-27 · Atualizado 2017-12-07 · CVE-2017-16961

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.20

Description A SQL injection issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack involves an admin/trees/add/process request with a crafted tags[] parameter that is mishandled in a later admin/ajax/dashboard/approve-change request.

Recommendations For BigTree CMS versions prior to 4.2.20, update to version 4.2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/trees/add/process and admin/ajax/dashboard/approve-change requests to minimize the risk of exploitation. Avoid using the tags[] parameter in the affected requests until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-16961

Produtos afetados

Bigtree Cms

Referências · 4

• 🔥 https://github.com/bigtreecms/BigTree-CMS/issues/323 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16961 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16961 · Nota
• https://osv.dev/vulnerability/CVE-2017-16961 · Aviso do Fabricante