#VU6902 Unrestricted file upload in BigTree CMS - CVE-2017-9364

Vulnerability identifier: #VU6902

Vulnerability risk: Medium

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Green]

CVE-ID: CVE-2017-9364

CWE-ID: CWE-434

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
BigTree CMS
Web applications / CMS

Vendor: BigTree CMS

Description
The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to absent validation of certain file extensions when uploading files. A remote attacker can upload files with .pht and .phtml extensions and execute them with privileges of the web server.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system, but requires that the web server is configured to treat the affected extensions as PHP files.

Mitigation
Install update from GIT repository.

Vulnerable software versions

BigTree CMS: 4.2 - 4.2.18

---

External links
https://github.com/bigtreecms/BigTree-CMS/commit/b72293946951cc650eaf51f5d2f62ceac6335e12
https://github.com/bigtreecms/BigTree-CMS/issues/280

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.