Executive brief
PbootCMS, a popular PHP-based content management system, contains a security flaw in its site configuration settings. An attacker with administrative access can inject malicious code into the website's footer information field. When the website is viewed by any user, this code executes on the server, potentially allowing the attacker to take full control of the website, steal data, or disrupt operations.
Technical details
A remote code execution (RCE) vulnerability exists in PbootCMS versions up to and including 3.2.12 due to insufficient sanitization of the 'Footer Information' (sitecopyright) field in the administrative backend. The root cause is located in the decode_string() function within /apps/home/controller/ParserController.php, where the sequential use of stripcslashes() and htmlspecialchars_decode() on user-supplied input allows executable PHP code to be restored and rendered. An authenticated attacker can inject a PHP payload into the site configuration, clear the template cache, and trigger execution by visiting any frontend page that utilizes the {pboot:sitecopyright} template tag. This can result in a full system compromise and the deployment of web shells.
Affected products
- PbootCMS PbootCMS <= 3.2.12
Timeline
- 2025-04-22: patched: Version 3.2.11 released (though vulnerability persists in 3.2.12)
- 2026-05-26: disclosed: CVE published