CVE-2026-76635: baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
baserCMSto a version that resolves this vulnerability.Fixed in 5.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated administrator-level access to baserCMS. The described attack path uses attacker-controlled table names and configuration values in database operations.
Which deployments are affected?
baserCMS versions before 5.3.0 are affected. The issue involves sequence updates, CSV exports, table-management operations, and backup restore processing.
What can an attacker obtain or do through exploitation?
The SQL injection can be used for error-based retrieval of the PostgreSQL database version, schema contents, and arbitrary data. The backup restore flaw can execute PHP code placed outside class definitions in schema files when those files are loaded.
How can I reduce exposure if I cannot upgrade immediately?
Restrict administrator access because exploitation requires an authenticated administrator. Avoid processing untrusted backup/schema files and limit access to database-management, CSV export, sequence-update, and table-management functions.