Description (CNA)
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| baserCMS Users Community / BcAddonMigrator | affected 0 through 5.2.0 |
CWE
CWE-829
References
- https://jvn.jp/en/jp/JVN21754394
- https://basercms.net/security/JVN_21754394
- https://github.com/baserproject/BcAddonMigrator/commit/e836bc875e26910e1b5862f96cf280b4f064c104
ADP enrichment
No English description supplied.
No references supplied.