CVE-2018-10183 An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI'] echo, as demonstrated by the dir parameter....
MediumCVSS 6.1
EPSS 0.68%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in BigTree 4.2.22. There is cross-site scripting (XSS) in /core/inc/lib/less.php/test/index.php because of a $_SERVER['REQUEST_URI'] echo, as demonstrated by the dir parameter in a file=charsets action.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bigtreecms bigtree cms | = 4.2.22 | No fix listed |
References
- github.com exploit third-party-advisory