GitHub Security Advisory: GHSA-qxmc-6f24-g86g
Package: baserproject/basercms (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 5.2.2
Patched in: 5.2.3

Summary: baserCMS has OS Command Injection Leading to Remote Code Execution (RCE)

Details:
## Summary

In the core update functionality of baserCMS, some parameters sent from the admin panel are passed to the `exec()` function without proper validation or escaping. This issue allows **an authenticated CMS administrator to execute arbitrary OS commands on the server (Remote Code Execution, RCE)**.

This vulnerability is not a UI-level issue such as screen manipulation or lack of CSRF protection, but rather stems from **a design that directly executes input values received on the server side as OS commands**. Therefore, even if buttons are hidden in the UI, or even if CakePHP's CSRF/FormProtection (SecurityComponent) ensures that only legitimate POST requests are accepted, **an attack is possible as long as a request containing a valid token is processed within an administrator session**.

---

## Vulnerability Information

| Item | Details |
| ---- | ------- |
| CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command |
| Impact | Remote Code Execution (RCE) |
| Severity | Critical |
| Attack Requirements | Administrator privileges required |
| Reproducibility | Reproducible (confirmed multiple times) |
| Test Environment | baserCMS 5.2.2 (Docker / development environment) |

---

## Affected Areas

- **Controller**
  - `PluginsController::get_core_update()`
- **Service**
  - `PluginsService::getCoreUpdate()`
- **Affected Endpoint**
  - `/baser/admin/baser-core/plugins/get_core_update`

---

## Technical Details

### Vulnerable Code Flow

```text
PluginsController::get_core_update()
  ↓ Retrieves php parameter from POST data
PluginsService::getCoreUpdate($targetVersion, $php, $force)
  ↓ Concatenates $php into command string without validation or escaping
exec($command)
```

### Relevant Code (Excerpt)

**PluginsController.php**

```php
$service->getCoreUpdate(
    $request->getData('targetVersion') ?? '',
    $request->getData('php') ?? 'php',
    $request->getData('force'),
);
```

**PluginsService.php**

```php
$command = $php . ' ' . ROOT . DS . 'bin' . DS . 'cake.php composer ' .
           $targetVersion . ' --php ' . $php . ' --dir ' . TMP . 'update';

exec($command, $out, $code);
```

The `$php` parameter is user input, and **none** of the following countermeasures are in place:

- Restriction via allowlist
- Validation via regular expression
- Escaping via `escapeshellarg()` or similar

---

## Attack Scenario

1. The attacker logs in as a CMS administrator
2. Sends a POST request to the core update functionality in the admin panel
3. Specifies a string containing OS commands in the `php` parameter
4. `exec()` is executed on the server side, running the arbitrary OS command

### Example Attack Input (Conceptual)

```text
php=php;id>/tmp/rce_test;#
```

---

## Verification Results (PoC)

### Execution Result

```bash
$ docker exec bc-php cat /tmp/rce_test
uid=1000(www-data) gid=1000(www-data) groups=1000(www-data)
```

The above confirms that OS commands can be executed with `www-data` privileges.

### Ad