baserCMS: SQL injection in administrative prefixes (CVE-2026-114621)

baserCMS versions 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 are susceptible to SQL injection via the Admin and Api/Admin prefixes. The vulnerability stems from the framework passing request query parameters (specifically contain, conditions, fields, finder, and order) directly to the ORM without sufficient validation. An authenticated attacker can embed SQL fragments within these parameters to manipulate database queries, potentially leading to unauthorized data extraction, such as password hashes. Disabling the core admin API does not mitigate this risk for users with active admin sessions. This issue is resolved in versions 5.3.2 and 5.4.2.

Impact

Successful exploitation allows an authenticated attacker with access to the administrative panel to perform arbitrary SQL operations against the underlying application database.

Recommendation

• Upgrade baserCMS instances to versions 5.3.2 or 5.4.2 immediately to remediate the ORM parameter validation flaw.
• Audit administrative session logs for unusual patterns or high-volume query parameter usage consistent with SQL injection payloads.
• Restrict access to administrative and API prefixes at the network or web application firewall level to trusted internal sources only.