Bcaddonmigrator
Monthly
Code execution in BcAddonMigrator 5.2.0 and earlier allows an authenticated administrative user to run arbitrary PHP by supplying a baserCMS4-style addon package whose config.php holds attacker-controlled code. The migration routine BcAddonMigrator5Component::migrateAddonConfig calls PHP's include on the uploaded config.php, so the file's contents execute with the web server's privileges during conversion, and the same code path can read or delete arbitrary files on the host. The CVSS 4.0 base score is 8.6, but the decisive limiting factor is PR:H - the attacker must already hold administrator rights - and no public exploit code or CISA KEV entry was identified at the time of analysis.
Code execution in BcAddonMigrator 5.2.0 and earlier allows an authenticated administrative user to run arbitrary PHP by supplying a baserCMS4-style addon package whose config.php holds attacker-controlled code. The migration routine BcAddonMigrator5Component::migrateAddonConfig calls PHP's include on the uploaded config.php, so the file's contents execute with the web server's privileges during conversion, and the same code path can read or delete arbitrary files on the host. The CVSS 4.0 base score is 8.6, but the decisive limiting factor is PR:H - the attacker must already hold administrator rights - and no public exploit code or CISA KEV entry was identified at the time of analysis.