baserCMS: SQL injection in admin panel and admin API

Summary

baserCMS, a PHP-based website framework, passes query parameters such as contain, conditions, fields, finder and order from admin list and detail actions directly to the ORM. An authenticated admin panel user can embed SQL fragments in these parameters to run arbitrary SQL against the database, including reading password hashes from the users table. The fixes in 5.3.1 and 5.4.1 covered only public pages and the public API. Setting USE_CORE_ADMIN_API to false does not prevent this access through a browser session.

Affected

• baserCMS 5.0.0 up to but excluding 5.3.2
• baserCMS 5.4.0 up to but excluding 5.4.2
• Unknown: whether 5.0.x, 5.1.x and 5.2.x receive a backport. No fixed version is listed for these lines.

Fixed in

• 5.3.2 for the 5.3 line
• 5.4.2 for the 5.4 line

Workaround

• Limit admin panel accounts to trusted users until the update is applied (vendor advisory).
• Setting USE_CORE_ADMIN_API to false is not an effective mitigation.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept was found in the research. Known exploitation is not reported in the sources.
• VulDB lists the entry as 0-Day, confirmed.

Our recommendation

• Identify all baserCMS instances and their exact versions, including 5.0 to 5.2 installations.
• Update 5.3.x installations to 5.3.2 and 5.4.x installations to 5.4.2.
• For systems that cannot be updated now, restrict admin accounts to trusted users and limit admin access to trusted networks.
• Review admin accounts and password policy, and rotate passwords if an admin account may have been exposed.
• Check the other baserCMS advisories published in the same batch when patching.
• Confirm the upgrade path with the vendor for 5.0 to 5.2 installations.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-2w6g-wp3r-26m3 github.com
• baserCMS 5.3.2 Release github.com
• baserCMS 5.4.2 Release github.com
• Fix commit 344de2a github.com
• VulDB entry 425953 vuldb.com
• NVD record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:42.