BigTree CMS through 4.2.17 relies on a substring check for CSRF protection, which allows remote attackers to bypass this check by placing the required admin/developer/ URI within a query string in an. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
PHP
CSRF
Bigtree Cms
Bigtreecms
NVD
GitHub
CVSS 3.0
8.8
EPSS
0.1%