Description

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-20T14:17:59.973Z",
  "pubdate": "2026-08-20T14:17:59.973Z",
  "executiveSummary": "An authenticated SQL injection vulnerability exists in baserCMS prior to version 5.3.0 within the BcDatabaseService.php component. The vulnerability allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations.\nBy leveraging this flaw, attackers can chain a backup restore code injection mechanism where PHP code located outside class definitions in schema files executes unconditionally upon loading. This enables the planting of malicious table names and the triggering of error-based SQL injection against the PostgreSQL backend.\nThe resulting impact includes the retrieval of sensitive database version information, schema contents, and arbitrary data from the underlying database. Successful exploitation requires administrative authentication to the target application and the ability to interact with specific database management functionalities.",
  "technicalDetails": "The vulnerability resides in the BcDatabaseService.php file of baserCMS affecting versions prior to 5.3.0. The root cause is the improper handling and direct inclusion of attacker-controlled table names and configuration values into constructed SQL queries without adequate sanitization or parameterized inputs.\nThe affected operations include sequence updates, CSV export functionalities, and overall table management features. Attackers possessing administrative privileges can manipulate these components to inject arbitrary SQL fragments, resulting in error-based SQL injection vulnerabilities targeting the PostgreSQL backend.\nThe attack flow involves chaining the SQL injection vector with a backup restore code injection flaw. In this secondary flaw, PHP code defined outside of class definitions within schema files is executed unconditionally by the application upon loading. An attacker uses this capability to plant malicious table names into the environment.\nOnce the malicious table names are established, subsequent sequence updates, CSV exports, or table management operations process the tainted inputs. When these inputs reach the vulnerable SQL generation routines in BcDatabaseService.php, the database executes the injected statements.\nThe post-exploitation impact includes the extraction of sensitive information such as the database version, complete schema contents, and arbitrary data stored within the PostgreSQL backend. The vulnerability strictly requires authenticated administrative access to initiate the attack sequence."
}