Executive brief
PbootCMS is a PHP-based content management system widely used for building enterprise websites. An authenticated attacker can exploit a SQL injection vulnerability in the user management module to modify arbitrary database fields, including passwords and user roles, enabling complete account takeover and unauthorized administrative access to the system.
Technical details
A SQL injection vulnerability exists in the mod() method of UserController.php and modUser() method of UserModel.php in PbootCMS versions 3.2.0 through 3.2.5. The vulnerability arises from unsanitized GET parameters (field and value) that are directly concatenated into SQL UPDATE statements without parameterized queries or field-name whitelisting. An authenticated attacker can specify any database column as the field parameter (such as password, username, status, or role) and inject arbitrary SQL via the value parameter. The attack requires prior authentication but allows modification of any user account attribute, leading to privilege escalation and account takeover. Patches are available in version 3.2.14 and later.
Affected products
- PbootCMS PbootCMS 3.2.0 through 3.2.5
Timeline
- 2026-09-09: disclosed
- other: Vendor released security patch in version 3.2.14 (2026-06-22 per security upgrade notification)