GHSA-hv78-cwp4-8r7r
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | baserproject/basercms | < 5.2.3 | 5.2.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Details
The application's restore function allows users to upload a `.zip` file, which is then automatically extracted. A PHP file inside the archive is included using `require_once` without validating or restricting the filename. An attacker can craft a malicious PHP file within the zip and achieve arbitrary code execution when it is included.
Vector: Malicious ZIP upload + insecure `require_once`
### PoC
1. Restore backup
1. Load file shell (insecure `require_once`)
### Impact
Remote Code Execution (RCE)
References
External links from the advisory. They lead to third-party sites.