baserCMS Code Injection Vulnerability in Mail Form Feature

Vulnerability

Description CVE-2023-43792 is a code injection vulnerability in the mail form feature of baserCMS, a PHP-based website development framework. The issue affects versions 4.6.0 through 4.7.6 [1]. Attackers can inject arbitrary code by exploiting insufficient input validation in the mail form, potentially leading to arbitrary file uploads [2].

Exploitation

This vulnerability can be exploited remotely without authentication, as no user interaction is required [3]. The attack complexity is low, and the attack vector is network-based, meaning an attacker only needs to send a crafted request to the vulnerable mail form endpoint to trigger the injection.

Impact

Successful exploitation allows an attacker to upload arbitrary files to the server, which may then be used to achieve remote code execution, compromise data integrity, or escalate privileges [2][3]. Given the absence of a patch at the time of disclosure, affected systems are at significant risk.

Mitigation

At the time of publication, no patched version is available [1]. The vendor recommends updating to the latest version once released [2]. As a workaround, administrators should disable the mail form plugin or implement strict input validation and file upload restrictions until a security update is applied.