PT-2017-18925 · Bigtree · Bigtree Cms

Xfkxfk · Publicado 2017-06-05 · Atualizado 2024-08-05 · CVE-2017-9443

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.2.18 and earlier

Description The issue allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in coreadminmodulesdeveloperextensionsinstallprocess.php and coreadminmodulesdeveloperpackagesinstallprocess.php. The vendor notes that any installed package or extension must be implicitly trusted as they have the ability to write PHP files.

Recommendations For BigTree CMS versions 4.2.18 and earlier, update to a version later than 4.2.18 to resolve the issue. As a temporary workaround, consider restricting the upload of packages and extensions to trusted sources only, and avoid using the tables object in manifest.json until a patch is available. Restrict access to the vulnerable process.php files in the coreadminmodulesdeveloperextensionsinstall and coreadminmodulesdeveloperpackagesinstall directories to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-9443

Produtos afetados

Bigtree Cms

Referências · 7

• 🔥 https://github.com/bigtreecms/BigTree-CMS/issues/292 · Exploit
• https://t.me/cvenotify/89251 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-9443 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9443 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9443 · Nota
• https://t.me/cvenotify/88221 · Publicação no Telegram
• https://t.me/cvenotify/87159 · Publicação no Telegram