PT-2017-14664 · Bigtree · Bigtree Cms

Xcold · Published 2017-11-27 · Updated 2017-12-07 · CVE-2017-16961

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.20

Description A SQL injection issue allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack involves an admin/trees/add/process request with a crafted tags[] parameter that is mishandled in a later admin/ajax/dashboard/approve-change request.

Recommendations For BigTree CMS versions prior to 4.2.20, update to version 4.2.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin/trees/add/process and admin/ajax/dashboard/approve-change requests to minimize the risk of exploitation. Avoid using the tags[] parameter in the affected requests until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-16961

Affected Products

Bigtree Cms

References · 4

• 🔥 https://github.com/bigtreecms/BigTree-CMS/issues/323 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16961 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16961 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16961 · Note