Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-20682

CVE-2021-20682: OS Command Injection in baserCMS

7.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-20682
GHSA ID
GHSA-g39q-f4rm-85x4
EPSS Score
0.85307%
CWE
CWE-78
Published
6/8/2021
Updated
7/6/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
baserproject/basercmscomposer< 4.4.54.4.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability explicitly involves OS command injection via plugin uploads, requiring admin privileges. The attack vector implies the function handling plugin uploads/installation is vulnerable. In PHP CMS frameworks like baserCMS, plugin management is typically handled by a PluginsController in the admin module. The function would execute OS commands (e.g., unzip, file moves) using untrusted input from the uploaded plugin, leading to injection. While no code is provided, the context (CWE-78, plugin upload vector) strongly points to this component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**s*r*MS v*rsions prior to *.*.* *llows * r*mot* *tt**k*r wit* *n **ministr*tiv* privil*** to *x**ut* *r*itr*ry OS *omm*n*s vi* uplo** o* m*li*ious plu*ins.

Reasoning

T** vuln*r**ility *xpli*itly involv*s OS *omm*n* inj**tion vi* plu*in uplo**s, r*quirin* **min privil***s. T** *tt**k v**tor impli*s t** `*un*tion` **n*lin* plu*in uplo**s/inst*ll*tion is vuln*r**l*. In `P*P` *MS *r*m*works lik* **s*r*MS, plu*in m*n*