CVE-2026-76635: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in baserproject basercms

CVE-2026-76635 is a SQL injection vulnerability affecting baserCMS before version 5.3.0. The flaw exists in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL commands. This occurs across multiple operations including sequence updates, CSV exports, and table management. Additionally, attackers can chain this with a backup restore code injection vulnerability that executes PHP code outside class definitions in schema files unconditionally upon loading. This chaining enables planting malicious table names that trigger error-based SQL injection, allowing attackers to retrieve the database version, schema contents, and arbitrary data from the PostgreSQL backend.

The vulnerability allows authenticated administrators to perform SQL injection attacks, potentially leading to unauthorized data disclosure from the PostgreSQL database. The chaining with a backup restore code injection flaw increases the risk by enabling arbitrary PHP code execution, which can facilitate further exploitation and data extraction. The CVSS 4.0 score of 8.6 reflects a high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to sequence updates, CSV exports, and table management operations. Avoid using backup restore features that may execute untrusted schema files.