JVN#61105618: baserCMS vulnerable to arbitrary file uploads

baserCMS provided by baserCMS Users Community allows an authenticated user to upload arbitrary files (CWE-434).

Impact

An user with Operator privilege may upload arbitrary files. As a result, arbitrary PHP code may be executed.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.
The developer released baserCMS 4.7.5 that contains a fix for this vulnerability.

Products Affected

• baserCMS versions prior to 4.7.5