PT-2015-7004

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 3.0.8 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions prior to 3.0.8, update to version 3.0.8 or later to resolve the issue...

CVE-2015-5641: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

baserCMS vulnerable to SQL injection

Overview baserCMS contains an SQL injection vulnerability. baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability that allows an authenticated user to inject arbitrary SQL statements CWE-89. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated...

JVN#79633796: baserCMS vulnerable to SQL injection

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability that allows an authenticated user to inject arbitrary SQL statements CWE-89. Impact A logged in attacker may execute arbitrary SQL statements. Solution Update the Software Update to the latest version...

JVN#04855224: baserCMS fails to restrict access permissions

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability where user settings may be changed when processing specially crafted request sent by an attacker logged into the system. Impact User information may be changed to arbitrary values by a logged in attacker...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

Code injection

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248

The CVE affects baserCMS 1.6.15 and earlier, where the vulnerability resides in app/config/core.php. In shared-hosting environments, installations may not be properly segregated, enabling an attacker with admin access on one domain to hijack sessions on another domain. This is a session managemen...

baserCMS vulnerable to session management

Overview baserCMS contains a vulnerability in session management. baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability in session management. Impact If a web server is hosting several websites, and baserCMS are installed on the respective websites, an...

JVN#53465692: baserCMS vulnerable to session management

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability in session management. Impact If a web server is hosting several websites, and baserCMS are installed on the respective websites, an administrator of a baserCMS can access baserCMS instance of the other...

PT-2012-3165

Name of the Vulnerable Software and Affected Versions baserCMS versions 1.6.15 and earlier Description The issue arises from improper handling of installations in shared-hosting environments, allowing remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248: Undefined Security Weakness

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2011-2673

Cross-site scripting XSS vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2674

BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors...

CVE-2011-2673

CVE-2011-2673 corresponds to a cross-site scripting (XSS) vulnerability in BaserCMS prior to 1.6.13.2. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected software is BaserCMS, with versions up to 1.6.13.1 explicitly mentioned; the vulnerabil...

CVE-2011-2674

CVE-2011-2674 affects BaserCMS prior to 1.6.12. The issue is an access-control bug where adding a user to the default operators group does not properly restrict privileges, allowing remote authenticated users to escalate privileges. Affected versions include BaserCMS 1.6.11.4 and earlier. Root ca...