CVE-2018-18942: Malicious File Upload

Q: What is the vulnerability ID of this baserCMS vulnerability?

The vulnerability ID of this baserCMS vulnerability is CVE-2018-18942.

Q: What is the severity of CVE-2018-18942?

The severity of CVE-2018-18942 is high with a score of 7.2.

Q: How can remote attackers exploit CVE-2018-18942?

Remote attackers can exploit CVE-2018-18942 by injecting arbitrary PHP code via the 'admin/theme_configs/form data[ThemeConfig][logo]' parameter.

Q: Which versions of baserCMS are affected by CVE-2018-18942?

Versions of baserCMS before 4.1.4 are affected by CVE-2018-18942.

Q: How can I fix the CVE-2018-18942 vulnerability in baserCMS?

To fix the CVE-2018-18942 vulnerability in baserCMS, update to version 4.1.4 or higher.

Published Nov 5, 2018

Updated

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/themeconfigs/form data[ThemeConfig][logo] parameter.

Other sources

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/themeconfigs/form data[ThemeConfig][logo] parameter.

Affected Software

2 affected componentsFixes available

composer/baserproject/basercms<4.1.4

4.1.4

baserCMS BaserCMS<4.1.4

Event History

Nov 5, 2018

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

May 13, 2022

Advisory Published

01:19 AM

Frequently Asked Questions

What is the vulnerability ID of this baserCMS vulnerability?

The vulnerability ID of this baserCMS vulnerability is CVE-2018-18942.

What is the severity of CVE-2018-18942?