A critical OS command injection vulnerability in baserCMS allows authenticated administrators to achieve full remote code execution on the underlying server host.

This issue is classified as an OS Command Injection vulnerability residing in the update functionality of the framework. An attacker must be authenticated with administrator-level privileges to trigger the flaw, allowing them to bypass application logic and execute system-level commands under the context of the web server user.

A successful exploit poses a severe threat to the confidentiality, integrity, and availability of the server environment. By executing arbitrary OS commands, an attacker can gain persistent access, exfiltrate sensitive database content, or pivot into the internal network. The CVSS score of 9.1 reflects the critical nature of potential total system compromise, despite the requirement for administrative authentication.

Immediate Action: Administrators must immediately upgrade baserCMS installations to version 5.2.3 or later to patch the vulnerable update component.

Proactive Monitoring: Security teams should review system audit logs for unusual shell activity or unexpected outbound connections originating from the web server process.

Compensating Controls: Implement strict egress filtering to prevent reverse shell connections and ensure the web server is running with the least privilege necessary to minimize the impact of command execution.

Public Exploit Available: false

The severity of this vulnerability necessitates an immediate update to version 5.2.3. Organizations should prioritize this patch to prevent administrative account compromise from escalating into a full server takeover. Ensure that all administrative credentials follow strong rotation policies to mitigate the risk of unauthorized access to the vulnerable update function.