GHSA-rjc2-x53r-6c9r

Suggest an improvement
Source
https://github.com/advisories/GHSA-rjc2-x53r-6c9r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rjc2-x53r-6c9r/GHSA-rjc2-x53r-6c9r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-rjc2-x53r-6c9r
Aliases
Published
2022-05-13T01:19:42Z
Modified
2024-02-16T05:37:13.142447Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
RCE in baserCMS before 4.1.4
Details

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Database specific 
{
    "github_reviewed_at": "2023-07-07T18:19:54Z",
    "cwe_ids": [
        "CWE-434"
    ],
    "severity": "HIGH",
    "nvd_published_at": "2018-11-05T09:29:00Z",
    "github_reviewed": true
}
References

Affected packages

Packagist / baserproject/basercms

Package

Name
baserproject/basercms
Purl
pkg:composer/baserproject/basercms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.4

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
1.*
1.0.0
2.*
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.0.0-rc5
2.0.0-rc6
2.0.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.0.21
3.0.22
3.0.23
3.0.24
3.0.25
3.0.26
4.*
4.0.0
4.1.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rjc2-x53r-6c9r/GHSA-rjc2-x53r-6c9r.json"