baserCMS Cross-site Scripting vulnerability in Site search Feature

Vulnerability

Overview

CVE-2023-44379 is a cross-site scripting (XSS) vulnerability present in the site search feature of baserCMS, a PHP-based website development framework. The root cause is that the search functionality does not properly escape user-supplied input before reflecting it in the page output. Specifically, the theme template files site_search_form.php or search.php use 'escape' => false in form control helpers, disabling output escaping [1][2].

Exploitation

Requirements

To exploit this vulnerability, an attacker must convince a user who has access to the management screen to interact with a crafted link or form. The vulnerability only applies when the management screen is made available to an unspecified number of users, such as in a multi-tenant or shared administration environment [2]. No authentication is required from the target user beyond being logged into the management interface.

Impact

Successful exploitation allows an attacker to inject arbitrary JavaScript or HTML into the vulnerable page, enabling actions such as session hijacking, content manipulation, or credential theft within the context of the affected user's session. The CVSS v3.1 score is not yet assigned, but the severity is moderate given the prerequisite of user interaction and the potential for sensitive data exposure.

Mitigation

Users should update to baserCMS 5.0.9, which includes a fix for this issue. Alternatively, administrators can manually remove the 'escape' => false option from the form control calls in their theme files, as detailed in the vendor advisory [2]. Users of the older baserCMS 4 series should consult separate guidance for mitigation. The vulnerability has been disclosed through JVN#73283159, and multiple researchers are credited for their reports [2][3].