CVE Catalog
CVE-2017-9364
CriticalSummary
BigTree CMS version 4.2.18 has an unrestricted file upload vulnerability. An attacker can upload an 'xxx.pht' or 'xxx.phtml' file, allowing them to bypass safety checks and execute arbitrary code.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious threat to the integrity and confidentiality of the system and user data.
Recommendation
It is recommended to update BigTree CMS to the latest version and implement additional file upload controls.
Original NVD description (English source)
Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.