Executive brief
baserCMS is a Japanese open-source content management system used to build and manage websites. The vulnerability allows authenticated administrators to inject malicious SQL code into database operations through unvalidated table names and configuration values, potentially exposing sensitive database contents, credentials, and user data. Additionally, a flaw in backup restoration validation permits execution of arbitrary PHP code to set up these injections.
Technical details
The vulnerability consists of two chained flaws in BcDatabaseService.php: (1) six raw SQL interpolation points that accept unsanitized table names and schema configuration values directly in SQL statements used during sequence updates, CSV exports, and table management; and (2) a schema file validation bypass (CWE-94) where PHP code outside class definitions in backup schema files executes unconditionally upon loading. An authenticated administrator can download a backup, inject malicious PHP into the schema file to create a table with a SQL injection payload as its name, upload the modified backup to trigger restoration, and then invoke updateSequence() to trigger error-based SQL injection that exfiltrates database metadata and version information from PostgreSQL. The attack requires administrative access but no patch is required beyond upgrading; version 5.2.10 and 5.3.0+ contain fixes using parameterized queries and AST-based code validation.
Affected products
- baserproject baserCMS before 5.2.10, before 5.3.0
Timeline
- 2026-07-30: disclosed
- 2026-07-30: patched