CVE-2017-7695

Published: Apr 11, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.

Affected (1)

Products: Bigtreecms: Bigtree Cms

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bigtreecms Bigtree Cms	Up to 4.2.16

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (6)

http://www.math1as.com/bigtree_upload.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/bigtreecms/BigTree-CMS/commit/8cf4212ea40e1b843e1aecf4b24681b0964ec04c

Source: cve@mitre.org

Patch

https://github.com/bigtreecms/BigTree-CMS/issues/276

Source: cve@mitre.org

Issue TrackingPatch

http://www.math1as.com/bigtree_upload.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/bigtreecms/BigTree-CMS/commit/8cf4212ea40e1b843e1aecf4b24681b0964ec04c

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/bigtreecms/BigTree-CMS/issues/276

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

Timeline

No history available yet.