CVE-2017-9444 BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), t...
HighCVSS 8.8
EPSS 0.45%
- Published
- Updated
- Exploit status
- No public exploit known
Description
BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script (modify user information), the index.php/admin/developer/packages/delete/ URI (remove packages), the index.php/admin/developer/upgrade/ignore/?versions= URI, and the index.php/admin/developer/upgrade/set-ftp-directory/ URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bigtreecms bigtree cms | <= 4.2.18 | No fix listed |
References
- github.com issue-tracking patch third-party-advisory