Read the docs
TI-2013-04283 Aliases CVE-2013-4879GHSA-4xfw-hc34-9cm8

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and…

Priority LOW 37CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.

Why it matters now

EPSS 0.02322 83rd percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:bigtreecms:bigtree_cms:*:rc2:*:*:*:*:*:*up to 4.0VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b1:*:*:*:*:*:*4.0 b1VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b2:*:*:*:*:*:*4.0 b2VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b3:*:*:*:*:*:*4.0 b3VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b4:*:*:*:*:*:*4.0 b4VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b5:*:*:*:*:*:*4.0 b5VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b6:*:*:*:*:*:*4.0 b6VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b7:*:*:*:*:*:*4.0 b7VulnerableBigtreecms
cpe:2.3:a:bigtreecms:bigtree_cms:4.0:rc1:*:*:*:*:*:*4.0 rc1VulnerableBigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:*:rc2:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b1:*:*:*:*:*:* Versions 4.0 b1 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b2:*:*:*:*:*:* Versions 4.0 b2 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b3:*:*:*:*:*:* Versions 4.0 b3 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b4:*:*:*:*:*:* Versions 4.0 b4 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b5:*:*:*:*:*:* Versions 4.0 b5 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b6:*:*:*:*:*:* Versions 4.0 b6 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:b7:*:*:*:*:*:* Versions 4.0 b7 Vulnerable ·Bigtreecms
  • cpe:2.3:a:bigtreecms:bigtree_cms:4.0:rc1:*:*:*:*:*:* Versions 4.0 rc1 Vulnerable ·Bigtreecms

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4879
  2. 2026-10-03 Alias added: GHSA-4xfw-hc34-9cm8

References

Exploit 3

Other 1

  • TI-2017-06855 BigTree CMS through 4.2.18 allows remote authenticated users to conduct SQL injection… CVSS 3.1HIGH 8.8
  • TI-2023-24036 Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to… CVSS 3.1MEDIUM 5.4
  • TI-2017-06853 Multiple cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow… CVSS 3.1LOW 2.7
  • TI-2018-07467 site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2017-05331 Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an… CVSS 3.0CRITICAL 9.8
  • TI-2017-06788 Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an… CVSS 3.0CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences