Arbitrary Code Execution via Crafted Package Upload in BigTree CMS

CVE-2017-9442 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:P/A:P

BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary code by uploading a crafted package containing a PHP web shell, related to extraction of a ZIP archive to filename patterns such as cache/package/xxx/yyy.php. This issue exists in core\admin\modules\developer\extensions\install\unpack.php and core\admin\modules\developer\packages\install\unpack.php. NOTE: the vendor states "You must implicitly trust any package or extension you install as they all have the ability to write PHP files.

Learn more about our Web App Pen Testing.