CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Management Module

Overview

Field	Detail
CVE ID	CVE-2026-79387
Product	PbootCMS
Affected Versions	3.2.0 – 3.2.5, and possibly earlier
Vulnerability Type	SQL Injection (CWE-89)
Attack Vector	Remote (Authenticated)
CVSS Severity	High
Discoverer	JiahaoLi
Vendor	https://www.pbootcms.com/

Vulnerability Description

A SQL injection vulnerability exists in the user management module of PbootCMS V3.2.5. The vulnerability resides in the mod() method of /apps/admin/controller/system/UserController.php (line 149) and the modUser() method of /apps/admin/model/system/UserModel.php.

The field parameter is fully user-controlled via a GET request without any whitelist validation. The value parameter is equally user-controlled and is directly concatenated into the SQL UPDATE statement. An authenticated attacker can specify any database column as field (e.g., password, username, status, role), enabling arbitrary data manipulation.

Root Cause

// UserController.php - mod() method
if (($field = get('field', 'var')) && ! is_null($value = get('value', 'var'))) {
    if ($this->model->modUser($ucode, "$field='$value',update_user='" . session('username') . "'")) {
        location(- 1);
    }
}

$field and $value are taken directly from the $_GET superglobal and concatenated into a SQL string with no sanitization, no whitelist, and no parameterized query. This string is then passed to UserModel::modUser(), which forwards it to the base Model::update() method. Since the argument is a string (not an array), it bypasses the checkKey() field-name validation and is embedded verbatim into the SET clause:

UPDATE ay_user SET <user-controlled>= '<user-controlled>', update_user='admin' WHERE ucode='<ucode>'

Call Chain

GET /admin.php?p=/User/mod&ucode=10002&field=password&value=<MD5>
  → UserController::mod()
    → UserModel::modUser($ucode, "password='<value>',update_user='admin'")
      → Model::table('ay_user')->where("ucode='$ucode'")->update($data_string)
        → SQL: UPDATE ay_user SET password='<value>',update_user='admin' WHERE ucode='10002'

Impact

An authenticated attacker  can:

1. Modify any user's password — including the super administrator (except the built-in founder ucode=10001).
2. Alter account status — enable or disable arbitrary accounts.
3. Inject deeper SQL — the value parameter allows single-quote escape, potentially enabling stacked or tautology-based attacks.

This leads to account takeover and complete control of the CMS backend.

Reproduction Steps

Prerequisites

• PbootCMS V3.2.5 installed locally (tested on 192.168.1.104, Apache/PHP 7.2.1/SQLite)
• A valid backend admin account

Step 1: Login to Admin Panel

Access the PbootCMS admin dashboard and log in with the default admin account.

Step 2: Create a Target User

Navigate to System Management → User Management → Add User. Create a new user:

• Username: admin2
• Password: admin
• Role: System Administrator

Step 3: Verify User Exists

The user list confirms admin2 with ucode=10002:

Step 4: Confirm Initial Password

Open a new browser window. Attempt to log in as admin2 with password 123456 — this fails because the actual password is admin:

Step 5: Craft and Execute the Payload

Using the already-logged-in admin browser, navigate to:

http://192.168.1.104/PbootCMS/admin.php?p=/User/mod&ucode=10002&field=password&value=14e1b600b1fd579f47433b88e8d85291

14e1b600b1fd579f47433b88e8d85291 is the MD5 hash of 123456.

The mod() method executes the injection and redirects via location(-1):

Step 6: Verify Password Change

Now attempt to log in with admin2 / 123456:

The password has been successfully changed via SQL injection. The user is now logged in with the new password, confirming full account takeover.

Source Code Analysis

Vulnerable Code (UserController.php, line ~149)

Database Layer (Model.php - update method)

When update() receives a string argument, it is used as-is in the SET clause without any escaping:

final public function update($data = null)
{
    if (is_array($data)) {
        // Array path: checkKey() validates field names
        ...
    } else {
        // String path: NO VALIDATION AT ALL
        $update_string = $data;
    }
    $this->sql['value'] = $update_string;
    $sql = $this->buildSql($this->updateSql);
    return $this->getDb()->amd($sql);  // Direct execution, no prepared statement
}

Remediation

1. Whitelist validation on the field parameter — only allow known column names (status, username, realname, password).
2. Parameterized queries — use prepared statements instead of string concatenation.
3. Escape user input — at minimum, sanitize $value to prevent quote-breakout.
4. Force password hashing — if field is password, apply encrypt_string() to the value before storage.
5. Restrict the standalone-modify path — the "single field modify" branch in mod() should require a valid CSRF token and role-level authorization check.

References

• PbootCMS Official Website
• PbootCMS Source on Gitee
• CVE-2026-79387

---

Disclosure: This vulnerability was responsibly disclosed to the vendor. If you are running an affected version, update immediately and audit all backend accounts.