Summary
A SQL injection vulnerability in baserCMS allows authenticated administrative users to influence ORM query options with SQL fragments. Under deployments where an attacker can log in to the admin panel, this may permit unauthorized database reads, including access to stored password hashes.
A SQL injection vulnerability in baserCMS allows authenticated administrative users to influence ORM query options with SQL fragments. Under deployments where an attacker can log in to the admin panel, this may permit unauthorized database reads, including access to stored password hashes.
Affected context
The issue occurs in baserCMS list and detail actions under the Admin and Api/Admin prefixes when request query parameters such as contain, conditions, fields, finder, or order are passed directly to ORM operations. It affects administrative paths that do not adequately constrain these parameters, even when public-page and public-API handling has been separately hardened.
The issue occurs in baserCMS list and detail actions under the Admin and Api/Admin prefixes when request query parameters such as contain, conditions, fields, finder, or order are passed directly to ORM operations. It affects administrative paths that do not adequately constrain these parameters, even when public-page and public-API handling has been separately hardened.
Exploit preconditions
- Attack surface: Authenticated administrative web and API endpoints
- Required access: A valid account able to log into the baserCMS admin panel
- Trigger point: List or detail actions that process attacker-influenced ORM query options
- Why exploitation is possible: Request parameters are incorporated into database query behavior without sufficiently restricting SQL-bearing input
- Attack surface: Authenticated administrative web and API endpoints
- Required access: A valid account able to log into the baserCMS admin panel
- Trigger point: List or detail actions that process attacker-influenced ORM query options
- Why exploitation is possible: Request parameters are incorporated into database query behavior without sufficiently restricting SQL-bearing input
Why this happens
The underlying bug is an unsafe trust boundary between HTTP request parameters and ORM query construction. Administrative actions accept query-related options such as filtering, field selection, finder selection, and ordering, then pass them to the ORM without applying sufficiently strict allowlisting or safe parameterization. This behavior maps to CWE-89 because attacker-controlled input can alter the intended structure or semantics of SQL statements.
The underlying bug is an unsafe trust boundary between HTTP request parameters and ORM query construction. Administrative actions accept query-related options such as filtering, field selection, finder selection, and ordering, then pass them to the ORM without applying sufficiently strict allowlisting or safe parameterization. This behavior maps to CWE-89 because attacker-controlled input can alter the intended structure or semantics of SQL statements.
Potential impact
- An attacker may read unauthorized application data
- Password hashes and other sensitive user records could be exposed
- Database integrity could be affected if the reachable query behavior permits modification
- Confidentiality and availability of administrative functions could be reduced
- Compromised data could support follow-on account or application attacks
- An attacker may read unauthorized application data
- Password hashes and other sensitive user records could be exposed
- Database integrity could be affected if the reachable query behavior permits modification
- Confidentiality and availability of administrative functions could be reduced
- Compromised data could support follow-on account or application attacks
General mitigation guidance
Mitigation generally focuses on maintaining a strict separation between
request data and database query structure.
Common defensive patterns include:
- Using parameterized ORM operations for all user-influenced values
- Allowlisting permitted fields, sort directions, relations, and finder names
- Rejecting unexpected query options before ORM processing
- Avoiding direct translation of arbitrary request parameters into query clauses
- Applying least-privilege database credentials and restricting sensitive table access
- Treating administrative sessions and administrative APIs as separate authorization boundaries
- Returning only the minimum fields required for each administrative operation
Mitigation generally focuses on maintaining a strict separation between
request data and database query structure.
Common defensive patterns include:
- Using parameterized ORM operations for all user-influenced values
- Allowlisting permitted fields, sort directions, relations, and finder names
- Rejecting unexpected query options before ORM processing
- Avoiding direct translation of arbitrary request parameters into query clauses
- Applying least-privilege database credentials and restricting sensitive table access
- Treating administrative sessions and administrative APIs as separate authorization boundaries
- Returning only the minimum fields required for each administrative operation
How teams detect issues like this
Detection can combine:
- Static analysis for request parameters passed directly into ORM conditions, ordering, field selection, or finder APIs
- Code review checks for dynamic query construction and insufficient allowlists
- Tests that submit unexpected query options and verify they are rejected or safely normalized
- Database monitoring for anomalous administrative queries, unusual schema access, or bulk reads
- Policy enforcement requiring parameterized queries and approved ORM query builders
- Automated security review tools that flag SQL construction from HTTP-controlled data
Detection can combine:
- Static analysis for request parameters passed directly into ORM conditions, ordering, field selection, or finder APIs
- Code review checks for dynamic query construction and insufficient allowlists
- Tests that submit unexpected query options and verify they are rejected or safely normalized
- Database monitoring for anomalous administrative queries, unusual schema access, or bulk reads
- Policy enforcement requiring parameterized queries and approved ORM query builders
- Automated security review tools that flag SQL construction from HTTP-controlled data
