GHSA-rjc2-x53r-6c9r

RCE in baserCMS before 4.1.4

Source: GitHub Advisory Database (reviewed) High CVE-2018-18942

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	baserproject/basercms	< 4.1.4	4.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

In baserCMS before 4.1.4, `lib\Baser\Model\ThemeConfig.php` allows remote attackers to execute arbitrary PHP code via the `admin/theme_configs/form data[ThemeConfig][logo]` parameter.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-18942 advisory
https://github.com/baserproject/basercms/issues/959 web
https://web.archive.org/web/20200130073341/https://basercms.net/release/4_1_4 web
https://web.archive.org/web/20211209034642/http://sunu11.com/2018/10/31/baserCMS web