CVE-2023-25654: baserCMS File Uploader Remote Code Execution (RCE) vulnerability
Summary
CVE-2023-25654: baserCMS File Uploader Remote Code Execution (RCE) vulnerability. Affects baserproject/basercms versions < 4.7.5. Fixed in 4.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
baserCMS is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features such as file management, user authentication, and template customization. The vulnerability in baserCMS allows remote attackers to execute arbitrary code on the target system, potentially leading to unauthorized access, data manipulation, or system compromise.
Vulnerability Detail
The vulnerability exists in the file uploader component of baserCMS. Attackers can exploit this vulnerability by uploading a malicious file with specially crafted content. When the file is processed by the CMS, the malicious code is executed, giving the attacker control over the system. This can result in unauthorized access, data theft, or further exploitation of the compromised system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Minimum fixed version
4.7.5
This is the first release that contains the fix.
composer require baserproject/basercms:4.7.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the file uploader functionality in baserCMS until the vulnerability is patched. This can be done by modifying the CMS configuration or removing the file uploader component from the system. However, this workaround may limit the functionality of the CMS and should only be considered if immediate patching is not feasible.
Conclusion
The baserCMS File Uploader Remote Code Execution (RCE) vulnerability allows attackers to execute arbitrary code on the target system. To mitigate this vulnerability, it is crucial to update baserCMS to the latest version (4.7.5 or above). Users can also utilize Vulert, a vulnerability monitoring tool, to check if their application is affected by this vulnerability. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for baserproject/basercms →
FAQ
baserCMS is an open-source content management system (CMS) used for creating and managing websites.
The vulnerability allows remote attackers to execute arbitrary code on the target system, potentially leading to unauthorized access, data manipulation, or system compromise.
To fix this vulnerability, update baserCMS to the latest version (4.7.5 or above) that includes patches and security enhancements.
Yes, you can disable the file uploader functionality in baserCMS until the vulnerability is patched. However, this may limit the CMS's functionality.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for baserproject/basercms.
