SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue.

baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time of publication, no known patched versions are available.

baserCMS has an OS command injection vulnerability in the installer.

Target baserCMS 5.2.2 and earlier versions

Vulnerability

If baserCMS is placed on a server but not installed, malicious commands may be executed.

Countermeasures Update to the latest version of baserCMS

Please refer to the following page to reference for more information. https://basercms.net/security/JVN54513170

Credits

REN XINGDIAN

Summary

In the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the exec() function without proper validation or escaping. This issue allows an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE).

This vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from a design that directly executes input values received on the server side as OS commands. Therefore, even if buttons are hidden in the UI, or even if CakePHP's CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, an attack is possible as long as a request containing a valid token is processed within an administrator session.

---

Vulnerability Information

| Item | Details | | ---- | ------- | | CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command | | Impact | Remote Code Execution (RCE) | | Severity | Critical | | Attack Requirements | Administrator privileges required | | Reproducibility | Reproducible (confirmed multiple times) | | Test Environment | baserCMS 5.2.2 (Docker / development environment) |

---

Affected Areas

- Controller - PluginsController::getcoreupdate() - Service - PluginsService::getCoreUpdate() - Affected Endpoint - /baser/admin/baser-core/plugins/getcoreupdate

---

Technical Details

Vulnerable Code Flow

text PluginsController::getcoreupdate() ↓ Retrieves php parameter from POST data PluginsService::getCoreUpdate($targetVersion, $php, $force) ↓ Concatenates $php into command string without validation or escaping exec($command)

Relevant Code (Excerpt)

PluginsController.php

php $service->getCoreUpdate( $request->getData('targetVersion') ?? '', $request->getData('php') ?? 'php', $request->getData('force'), );

PluginsService.php

php $command = $php . ' ' . ROOT . DS . 'bin' . DS . 'cake.php composer ' . $targetVersion . ' --php ' . $php . ' --dir ' . TMP . 'update';

exec($command, $out, $code);

The $php parameter is user input, and none of the following countermeasures are in place:

- Restriction via allowlist - Validation via regular expression - Escaping via escapeshellarg() or similar

---

Attack Scenario

1. The attacker logs in as a CMS administrator 2. Sends a POST request to the core update functionality in the admin panel 3. Specifies a string containing OS commands in the php parameter 4. exec() is executed on the server side, running the arbitrary OS command

Example Attack Input (Conceptual)

text php=php;id>/tmp/rcetest;#

---

Verification Results (PoC)

Execution Result

bash $ docker exec bc-php cat /tmp/rcetest uid=1000(www-data) gid=1000(www-data) groups=1000(www-data)

The above confirms that OS commands can be executed with www-data privileges.

Additional Notes

- Reproducible through the legitimate flow in the admin panel (browser) - Succeeds even with CSRF/FormProtection tokens included in a legitimate request - Failure cases (400/403) have also been investigated and differentiated - Confirmed reproducible via resending HTTP requests with tools such as curl (resending the same request containing valid tokens)

---

Impact

If this vulnerability is exploited, the following becomes possible:

- Retrieval of server information - Reading/writing arbitrary files - Retrieval of application configuration information (DB credentials, etc.) - OS-level operations beyond application permission boundaries

Although administrator privileges are required, this is a design issue where the impact extends from the application layer to the OS layer, and the impact is considered significant.

---

Recommended Fix

Primary Recommendation

- Do not accept the PHP executable path from user input - Fix the PHP executable on the server side using the PHPBINARY constant

php $php = escapeshellarg(PHPBINARY);

Supplementary Fix Recommendations

- Apply escapeshellarg() escaping to other command-line arguments (version number, directory, etc.) as well - If possible, consider using execution methods that do not involve shell interpretation (array format, Process class, etc.)

Alternative (Not Recommended)

- Allowlist validation for the PHP executable path - Combined use of regex validation and escapeshellarg()

However, from the perspective of reducing the attack surface, a design that eliminates user input entirely is recommended.

---

Additional Notes

- This issue is independent of UI display controls (showing/hiding buttons) - As long as the endpoint exists, an attack is possible if a request containing valid tokens is processed - This is a problem stemming from the design-level handling of input, and cannot be prevented by CSRF or UI controls alone

---

Conclusion

Due to a design issue in baserCMS's core update functionality where user input is passed to exec() without validation, Remote Code Execution (RCE) is achievable with administrator privileges. This vulnerability can be fixed through input validation and design review, and prompt remediation is recommended.

This advisory was translated from Japanese to English using GitHub Copilot.

Summary The latest version of baserCMS (basercms-5.2.2) contains an OS command injection vulnerability (CWE-78) in its update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitrary OS commands on the server with the privileges of the user account running baserCMS.

Details Please refer to the attached materials. OSコマンドインジェクション（baserCMSのアップデート機能）.pdf

Impact An authenticated user with administrator privileges in baserCMS can execute OS commands on the server with the privileges of the user account running baserCMS.

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors.

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.

Details The application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using requireonce without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included.

Vector: Malicious ZIP upload + insecure requireonce

PoC 1. Restore backup !image 1. Load file shell (insecure requireonce) !image !image

Impact Remote Code Execution (RCE)

baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1.

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

baserCMS is a website development framework. Prior to version 5.0.9, there is an OS Command Injection vulnerability in the site search feature of baserCMS. Version 5.0.9 contains a fix for this vulnerability.

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.

baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1.

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.