baserCMS vulnerabilities

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes 'config.php' from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow an attacker to execute arbitrary PHP code on the server via unspecified vectors.

baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow remote attackers to delete arbitrary files via unspecified vectors when the 'File' field is being used in the mail form.

CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

The CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Version 3.0.10 and earlier of baserCMS contains a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators and execute arbitrary PHP code via unspecified vectors.

A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

In baserCMS, PermissionGroupsService::build() reads a plugin's config/permission.php to determine user group permissions. When that file is absent, it writes a wildcard allow rule for every non-admin group. BcCustomContent has no such file in any release, so after an administrator installs it, the default operators group can store and execute arbitrary PHP under the document root.

In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public mail message API endpoint does not enforce the form's auth_captcha setting. An unauthenticated attacker can automate submissions without solving the captcha.

In baserCMS versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field, causing a single auto-reply to be addressed to multiple third parties.

In baserCMS, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comments supplied by unauthenticated visitors. A comment containing the BcBaser.getGoogleMaps shortcode can set apiBaseUrl to an attacker-controlled script URL, which is emitted as a script src and executes JavaScript on the site's origin when another visitor or administrator opens the article displaying that comment. Escaping raw HTML in comments does not prevent this stored cross-site scripting because shortcode processing happens after HTML rendering.

In baserCMS, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end rendering and API responses, deserialize the stored value with unserialize() without an allowed_classes restriction, accepting both raw and base64-encoded serialized data. An administrator, or an attacker who obtains widget-write capability through a separate vulnerability such as chained XSS, can plant an object graph that subsequently triggers on unauthenticated page requests.

In baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin. This can disclose application source and database credentials in config/install.php.

In the optional BcThemeFile plugin of baserCMS, the Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary.

In baserCMS, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths.

A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.

A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.

A missing authentication for critical function vulnerability exists in baserCMS. If exploited, a remote attacker may obtain sensitive information.

A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If exploited, an arbitrary script may be executed in the user's web browser.

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.

BaserCMS contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.

A directory listing vulnerability in the baserCMS plugin for BurgerEditor and BurgerEditor Limited Edition before version 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of uploaded files.