What is CVE-2017-16961?

CVE-2017-16961 is a medium-severity vulnerability in Bigtreecms Bigtree Cms, classified under SQL Injection. CVSS score: 6.5/10. Published 2017-11-27.

How severe is CVE-2017-16961?

Medium severity. CVSS v3 base score is 6.5 out of 10.

SQL Injection in Bigtreecms Bigtree Cms

CVE-2017-16961

A SQL injection vulnerability in core/inc/auto-modules.php in BigTree CMS through 4.2.19 allows remote authenticated attackers to obtain information in the context of the user used by the application to retrieve data from the database. The attack uses an admin/trees/add/process request with a crafted _tags[] parameter that is mishandled in a later admin/ajax/dashboard/approve-change request.

Vulnerability class: SQL Injection

EPSS: 0.014 (69.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Bigtreecms Bigtree_cms
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

cve@mitre.org (Exploit, Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2017-16961?: CVE-2017-16961 is a medium-severity vulnerability in Bigtreecms Bigtree Cms, classified under SQL Injection. CVSS score: 6.5/10. Published 2017-11-27.
How severe is CVE-2017-16961?: Medium severity. CVSS v3 base score is 6.5 out of 10.