SunCSR (ThienNV and HoaVT - Sun* Cyber Security Research)

3 exploits Active since Jun 2021
CVE-2020-26670 EXPLOITDB HIGH text WORKING POC
BigTree CMS <4.4.10 - Command Injection
A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function.
CVSS 8.8
CVE-2020-26669 EXPLOITDB MEDIUM text WORKING POC
BigTree CMS < 4.4.10 - Authenticated Stored Cross-Site Scripting via Page Content
A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update.
CVSS 5.4
CVE-2020-26668 EXPLOITDB HIGH text WORKING POC
BigTree CMS <4.4.10 - SQL Injection
A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to inject a malicious SQL query to the applications via the 'Create New Feed' function.
CVSS 8.8