RCE in baserCMS before 4.1.4

ALTO 7.2CVE-2018-18942 · GHSA-rjc2-x53r-6c9r · Published 05/11/2018 · updated 17/06/2026

En resumen

CVE-2018-18942 es una vulnerabilidad ALTO (CVSS 7.2) que afecta a baserproject/basercms, basercms (basercms).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.4%, mayor que el 84.0% de las vulnerabilidades.
Solución: actualizar a 4.1.4 o posterior.

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`< 4.1.4`	`4.1.4`
basercms basercms	`< 4.1.4`	`4.1.4`

Description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

NVD description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

References

nvd.nist.gov/vuln/detail/CVE-2018-18942 · ADVISORY
baserproject/basercms · WEB
web.archive.org/web/20200130073341/https://basercms.net/release/4_1_4 · WEB
web.archive.org/web/20211209034642/http://sunu11.com/2018/10/31/baserCMS · WEB
sunu11.com/2018/10/31/baserCMS · Exploit
basercms.net/release/4_1_4 · Release Notes

Más vulnerabilidades de baserproject/basercms

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

baserproject/basercms

Packagist

< 4.1.4

4.1.4

basercms

< 4.1.4

4.1.4

Description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

NVD description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Más vulnerabilidades de baserproject/basercms

Ver todo →