** DISPUTED ** BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files."
References
Link | Resource |
---|---|
https://github.com/bigtreecms/BigTree-CMS/issues/291 | Exploit Third Party Advisory |
https://github.com/bigtreecms/BigTree-CMS/issues/291 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 03:36
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/bigtreecms/BigTree-CMS/issues/291 - Exploit, Third Party Advisory |
Information
Published : 2017-06-05 19:29
Updated : 2024-11-21 03:36
NVD link : CVE-2017-9442
Mitre link : CVE-2017-9442
CVE.ORG link : CVE-2017-9442
JSON object : View
Products Affected
bigtreecms
- bigtree_cms
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')