Executive brief
PbootCMS is a PHP-based content management system used to build and manage websites. The admin panel contains a user management module that allows administrators to add, edit, delete backend users, and change user status. Due to missing CSRF protection on sensitive GET endpoints, an attacker can trick a logged-in administrator into clicking a malicious link or visiting a page with an embedded image tag, causing the administrator to unknowingly delete other users or disable their accounts without any confirmation.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw in PbootCMS's UserController class affecting the del() and mod() methods in apps/admin/controller/system/UserController.php. These methods perform sensitive write operations (user deletion and status modification) via GET requests without any CSRF token validation. The application's only CSRF protection mechanism (formcheck token validation in AdminController) is limited to POST requests and does not cover GET operations. An unauthenticated attacker can craft a malicious link or page containing an image/iframe pointing to the vulnerable endpoints (e.g., /admin.php?p=/User/del&ucode=10099), which will be executed when a logged-in administrator visits the attacker's page, leveraging the administrator's valid session cookie. The patch in version 3.2.25 converts these operations to POST and integrates them with the existing formcheck CSRF protection mechanism.
Affected products
- PbootCMS PbootCMS up to 3.2.24
Timeline
- 2026-08-19: disclosed: Vulnerability reported on GitHub issue #70
- 2026-09-07: patched: Version 3.2.25 released with patch c25241a0964742cefb7f698efbb6c38b868d6ff7
- 2026-09-16: advisory: CVE-2026-92383 published on NVD