Skip to content

CVE-2017-9449 SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker cr...

HighCVSS 8.8 EPSS 1.1%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible at admin/ajax/auto-modules/views/searchable-page/ or admin/modules_name.

Affected products

ProductAffected versionsFixed in
bigtreecms bigtree cms <= 4.2.18 No fix listed

References

  • github.com issue-tracking patch third-party-advisory