| Package | Affected versions | Patched versions |
|---|---|---|
| bigtree cms | ≤ 4.2.18 |
BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection attacks via a crafted tables object in manifest.json in an uploaded package. This issue exists in core\admin\modules\developer\extensions\install\process.php and core\admin\modules\developer\packages\install\process.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free