Description
app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain.
References
- JVNDB-2012-000043 third-party-advisory
- JVN#53465692 third-party-advisory
- basercms-core-sec-bypass(75660) vdb-entry
- http://basercms.net/security/1
- 53543 vdb-entry