CVE-2026-114621: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in baserproject basercms

baserCMS is affected by an SQL injection vulnerability (CWE-89) in versions >=5.0.0 <5.3.2 and >=5.4.0 <5.4.2. The issue occurs because list and detail actions in the Admin and Api/Admin prefixes pass request query parameters such as contain, conditions, fields, finder, and order directly to the ORM without proper neutralization. An authenticated user with admin panel access can exploit this to execute arbitrary SQL commands, including reading sensitive data like password hashes. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not address the administrative paths. The vulnerability is fixed in versions 5.3.2 and 5.4.2.

An attacker with authenticated access to the admin panel can execute arbitrary SQL commands against the application's database. This can lead to unauthorized data disclosure, including reading password hashes from the users table, and potentially full compromise of the database integrity and availability.

This vulnerability has been officially fixed in baserCMS versions 5.3.2 and 5.4.2. Users should upgrade to these versions or later to remediate the issue. No other mitigations are indicated, and disabling USE_CORE_ADMIN_API does not prevent exploitation through authenticated sessions.