CVE-2017-9442

BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to…

published June 5, 2017

CVSS
—
EPSS
2%
Percentile
84.2
In the wild
Unconfirmed
What it is

BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02451 · 84.2th percentile
Published
2017-06-05T19:00Z
EPSS history
Timeline
  • 05 JUN 19:00Z
    BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to…
    cvelistv5