A SQL injection flaw exists in the blog post handling component of baserCMS, allowing an attacker to insert arbitrary SQL statements. This weakness aligns with CWE-89, where special characters in user input are not properly neutralized. An attacker could potentially read confidential database content, modify or delete records, and compromise data integrity.

Any installation of baserCMS from baserproject running a version older than 5.2.3 is vulnerable. The issue was addressed in the 5.2.3 release, and later versions are considered safe from this specific flaw.

The vulnerability has a CVSS v3 score of 6.9, indicating moderate severity. EPSS information is not available, and it is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting limited public exploitation. The likely attack vector is the web interface that accepts blog post input, as described. No further exploitation conditions are detailed in the advisory.