CVE-2026-76635 in BaserCMS
Summary
by MITRE • 08/20/2026
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in baserCMS versions prior to 5.3.0 represents a critical security flaw rooted in insufficient input validation within the BcDatabaseService component. This weakness specifically affects authenticated administrators, allowing them to manipulate SQL queries by injecting attacker-controlled table names and configuration values directly into database operations. The affected functions include sequence updates, CSV exports, and general table management tasks. Because these operations involve direct interaction with the underlying PostgreSQL backend without adequate sanitization of user-supplied data, an authorized but malicious actor can exploit this lack of validation to execute arbitrary SQL commands. This scenario highlights a classic failure in input handling where trusted roles are assumed to be safe from injection attacks, ignoring the reality that insider threats or compromised credentials pose significant risks when application logic does not enforce strict parameterization.
A particularly dangerous aspect of this vulnerability is its potential for chaining with another flaw involving backup restore functionality. The system contains a code execution weakness wherein PHP code located outside class definitions in schema files executes unconditionally upon loading during the restoration process. An attacker can leverage this to plant malicious table names that, when processed by the vulnerable database service functions, trigger error-based SQL injection techniques. This chaining capability significantly amplifies the impact of the initial vulnerability. By forcing the database engine to return errors containing sensitive information, the attacker can extract detailed insights about the PostgreSQL backend environment. These details include the specific version of the database software, the structure and contents of the schema, and potentially arbitrary data stored within the application's tables. This level of access effectively compromises the integrity and confidentiality of the entire system infrastructure supported by baserCMS.
From a classification perspective, this vulnerability aligns with CWE-89, which covers Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The specific mechanism described, where error messages are leveraged to extract data, corresponds closely to the Error-Based sub-category within that standard. Furthermore, the exploitation path involving backup restoration and subsequent code execution touches upon CWE-94, Improper Control of Generation of Code (Code Injection), although the primary vector for data exfiltration remains SQL injection. In terms of adversary tactics, this behavior maps to ATT&CK technique T1059, Command and Scripting Interpreter, due to the PHP code execution aspect, as well as T1213, Data from Information Repositories, which describes how attackers gather information about networked devices or databases to facilitate further attacks. The ability to retrieve schema contents also relates to reconnaissance activities that allow for deeper penetration of the target environment.
The operational impact of this vulnerability is severe, particularly because it requires only authenticated access rather than unauthenticated remote code execution. While authentication provides a layer of defense against casual external attackers, it does not mitigate risks from compromised administrative accounts or insider threats with legitimate credentials. Once exploited, the attacker gains read-only to write-access capabilities depending on database permissions, potentially leading to full system compromise if combined with other vulnerabilities in the stack. The extraction of schema details and arbitrary data can lead to significant privacy violations and regulatory non-compliance under frameworks such as GDPR or HIPAA, depending on the nature of the stored data. Additionally, knowledge of the PostgreSQL version aids attackers in identifying known exploits for that specific database release, further escalating the threat landscape.
Mitigation strategies must focus primarily on upgrading to baserCMS version 5.3.0 or later, where these vulnerabilities have been addressed by developers through improved input validation and secure coding practices. For organizations unable to upgrade immediately due to compatibility constraints, implementing strict web application firewall rules can help detect and block SQL injection patterns in HTTP requests targeting the affected endpoints. It is also critical to enforce principle of least privilege for database accounts used by the CMS, ensuring that even if an injection occurs, the attacker cannot perform destructive actions or access unrelated databases. Regular audits of backup restoration processes should be conducted to ensure no executable code exists outside intended class definitions within schema files. Finally, enabling detailed logging and monitoring on both the web server and database engine can aid in early detection of such exploitation attempts by alerting administrators to unusual query patterns or error responses indicative of injection attacks.