CVE-2017-9443 | BDVDB-2026-86101 Detail

Description#

BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12017-06-05Record published in the CVE List.
2. Version 22024-09-17Most recent update recorded in the CVE List.