CVE-2026-76635
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
Risk Assessment
An authenticated administrator can gain unauthorized access to data in the database, including sensitive information, and potentially modify the database structure, which can lead to data integrity compromise and further attacks.
Recommendation
It is recommended to immediately upgrade baserCMS to version 5.3.0 or later, which includes fixes. Also, restrict administrator privileges and monitor logs for suspicious database-related activities.
Other vulnerabilities in baserCMS
See all- CVE-2017-10844High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow an attacker to execute arbitrary PHP code on the server via unspecified vectors.
- CVE-2017-10843High
baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allow remote attackers to delete arbitrary files via unspecified vectors when the 'File' field is being used in the mail form.
- CVE-2016-4882High
CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4878High
The CSRF vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
- CVE-2016-4876High
Version 3.0.10 and earlier of baserCMS contains a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators and execute arbitrary PHP code via unspecified vectors.
- CVE-2017-10842Critical
A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2026-65875High
BaserCMS contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.
- CVE-2024-44807Medium
A directory listing vulnerability in the baserCMS plugin for BurgerEditor and BurgerEditor Limited Edition before version 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of uploaded files.
Original NVD description (English source)
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.