baserCMS CVE-2026-76635

Exploitation requires a valid baserCMS administrator account - confirmed by the CVSS 4.0 PR:H metric. The attacker must have access to the baserCMS administrative panel and specifically to the backup restore functionality (to inject PHP into schema files) and to at least one of the affected database management operations (sequence update, CSV export, or table management). The backup restore step requires the ability to upload or supply schema files, which is an administrator-only capability. Limiting factors: (1) administrator-level credentials are mandatory - this is not exploitable by lower-privilege users or unauthenticated actors; (2) the technique is described for a PostgreSQL backend specifically, using error-based exfiltration; behavior against MySQL or SQLite backends is not confirmed; (3) the chained attack requires two sequential steps (schema file injection followed by SQL injection trigger), increasing execution complexity compared to a single-step exploit; (4) the admin panel must be network-accessible to the attacker, though this is satisfied by default for most internet-facing deployments.

The CVSS 4.0 score of 8.6 with PR:H accurately reflects the high privilege requirement - exploitation is gated behind authenticated administrator access, which is the primary limiting factor. Despite the network attack vector (AV:N), the realistic attacker population is constrained to compromised admin credentials or insider threats rather than anonymous remote actors. No EPSS score was provided; without it, relative exploitation probability versus other vulnerabilities cannot be quantified. The vulnerability is not in CISA KEV, and no public exploit code has been identified at time of analysis - however, the chained technique is described in sufficient detail in the VulnCheck advisory to lower the barrier for technically capable actors. The chained nature of the attack (code injection prerequisite before SQL injection trigger) adds real-world complexity beyond what AC:L in the CVSS vector suggests: two distinct exploit steps must succeed sequentially. Confidentiality, integrity, and availability are all rated High in the CVSS 4.0 vector, reflecting full database read/write access as the worst-case outcome. Organizations should prioritize patching if their baserCMS admin panel is exposed to the internet or if they operate multi-tenant environments where different users hold admin roles.

An attacker who has obtained baserCMS administrator credentials - through phishing, credential stuffing, or insider access - navigates to the backup restore functionality and uploads a crafted schema file containing PHP code outside class definitions; upon loading, this code executes unconditionally and plants an attacker-controlled table name into the CMS configuration. The attacker then triggers a database management operation (such as a sequence update or CSV export) that passes the poisoned table name unsanitized into a SQL query in BcDatabaseService.php, causing the PostgreSQL backend to return verbose error messages containing leaked database version strings, schema details, and sensitive table contents. No public exploit code has been identified, but the VulnCheck advisory provides sufficient technical specificity to make independent reproduction feasible for skilled actors.