Unscored severity · published Aug 19, 2013
CVE-2013-4881
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site request forgery (CSRF) vulnerability in core/admin/modules/users/create.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create an administrative user via an add user action to index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bigtree Cms · Bigtreecms
through 4.0; 4.0; 4.0; 4.0; 4.0; 4.0; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4881
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2013-08/0039.html
osvdb.org
http://osvdb.org/96009
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/86286
github.com
https://github.com/bigtreecms/BigTree-CMS/commit/4b0faa90fa8b9e1776c86db716894dcd7e6b4834
www.htbridge.com
https://www.htbridge.com/advisory/HTB23165
More from Bigtree Cms
9.8
CVE-2018-10574
site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in…
9.8
CVE-2017-9364
Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code
9.8
CVE-2017-7695
Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code
8.8
CVE-2020-26670
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the…
8.8
CVE-2020-26668
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to…