RCE in baserCMS before 4.1.4

ALTO 7.2CVE-2018-18942 · GHSA-rjc2-x53r-6c9r · Published 05/11/2018 · updated 17/06/2026

In breve

CVE-2018-18942 è una vulnerabilità ALTO (CVSS 7.2) che riguarda baserproject/basercms, basercms (basercms).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.4%, superiore al 84.0% delle vulnerabilità.
Correzione: aggiornare a 4.1.4 o successiva.

Package	Affected versions	Patched versions
baserproject/basercms Packagist	`< 4.1.4`	`4.1.4`
basercms basercms	`< 4.1.4`	`4.1.4`

Description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

NVD description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

References

nvd.nist.gov/vuln/detail/CVE-2018-18942 · ADVISORY
baserproject/basercms · WEB
web.archive.org/web/20200130073341/https://basercms.net/release/4_1_4 · WEB
web.archive.org/web/20211209034642/http://sunu11.com/2018/10/31/baserCMS · WEB
sunu11.com/2018/10/31/baserCMS · Exploit
basercms.net/release/4_1_4 · Release Notes

Altre vulnerabilità di baserproject/basercms

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

baserproject/basercms

Packagist

< 4.1.4

4.1.4

basercms

< 4.1.4

4.1.4

Description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

NVD description

In baserCMS before 4.1.4, lib\Baser\Model\ThemeConfig.php allows remote attackers to execute arbitrary PHP code via the admin/theme_configs/form data[ThemeConfig][logo] parameter.

Altre vulnerabilità di baserproject/basercms

Vedi tutto →