CVE-2013-5313

Published: Aug 19, 2013Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action.

Affected (9)

Products: Bigtreecms: Bigtree Cms

Bigtreecms

1 product

Bigtree Cms

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Bigtreecms Bigtree Cms	Up to 4.0
Bigtreecms Bigtree Cms	Version 4.0 b1
Bigtreecms Bigtree Cms	Version 4.0 b2
Bigtreecms Bigtree Cms	Version 4.0 b3
Bigtreecms Bigtree Cms	Version 4.0 b4
Bigtreecms Bigtree Cms	Version 4.0 b5
Bigtreecms Bigtree Cms	Version 4.0 b6
Bigtreecms Bigtree Cms	Version 4.0 b7
Bigtreecms Bigtree Cms	Version 4.0 rc1

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834

Source: cve@mitre.org

ExploitPatch

https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.