Simple Php Cms
Monthly
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. [CVSS 4.7 MEDIUM]
SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.
Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the `image` parameter in the `/admin/edit.php` Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.
A vulnerability was found in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/editsite.php. [CVSS 4.7 MEDIUM]
SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.
Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the `image` parameter in the `/admin/edit.php` Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.