-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| baserproject/basercms | composer | >= 4.0.0, <= 4.1.0.1 | |
| baserproject/basercms | composer | <= 3.0.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper access control around PHP code execution in fixed pages. The advisories explicitly link the issue to PHP code handling in fixed pages and provide a configuration flag ('BcApp.allowedPhpOtherThanAdmins') to restrict non-admin access. The FixedPagesController's edit action would be the logical entry point for content modification, while BcBaserHelper's PHP evaluation function would directly process untrusted input. The combination of these components creates an OS command injection vector when attackers inject PHP code containing system()/exec() calls.
A Semantic Attack on Google Gemini - Read the Latest Research