baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.3.2, 5.4.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
baserCMS, a website development framework, is affected, specifically its mail-form auto-reply feature in public forms with an email field that lacks server-side email validation. An unauthenticated visitor can exploit this to make the site send a single auto-reply to multiple third-party addresses, enabling the site to be abused to deliver unsolicited mail under the site's sender identity.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- baserproject basercms
From 5.2.5 · fixed in 5.3.2; From 5.4.0 · fixed in 5.4.2