baserCMS versions prior to 5.3.0 contain a dual flaw in BcDatabaseService.php that enables authenticated administrators to perform SQL injection by inserting attacker‑controlled table names and configuration values into queries used for sequence updates, CSV export, and table management. The vulnerability can be chained with a backup‑restore code injection flaw, where PHP code placed outside class definitions in schema files executes automatically when the backup is restored. This combination allows an attacker to both inject malicious code that runs on the server and to trigger error‑based SQL injection that reveals database schema information and arbitrary data from the PostgreSQL backend. The weaknesses are represented by CWE‑89 (SQL injection) and CWE‑94 (code injection).

All installations of baserProject baserCMS older than version 5.3.0 are affected. The affected software is distributed under the baserproject:basercms product line. Users of baserCMS should verify the version of their deployment and plan an upgrade to version 5.3.0 or later to address the flaw.

The CVSS score of 8.6 indicates a high‑severity vulnerability. No EPSS data is available, and baserCMS is not listed in the CISA KEV catalog. Exploitation requires an authenticated administrator account; the attacker must create or modify a backup schema file to inject code, then trigger a restore operation that causes the injected code to execute. Once code runs, the attacker can read or modify arbitrary database content, effectively achieving remote code execution. The risk remains significant for systems that support public or internal user interactions.