Vulnerability Description

A SQL injection vulnerability exists in the user management module of PbootCMS V3.2.5. The vulnerability resides in the mod() method of /apps/admin/controller/system/UserController.php (line 149) and the modUser() method of /apps/admin/model/system/UserModel.php.

The field parameter is fully user-controlled via a GET request without any whitelist validation. The value parameter is equally user-controlled and is directly concatenated into the SQL UPDATE statement. An authenticated attacker can specify any database column as field (e.g., password, username, status, role), enabling arbitrary data manipulation.

Root Cause

$field and $value are taken directly from the $_GET superglobal and concatenated into a SQL string with no sanitization, no whitelist, and no parameterized query. This string is then passed to UserModel::modUser(), which forwards it to the base Model::update() method. Since the argument is a string (not an array), it bypasses the checkKey() field-name validation and is embedded verbatim into the SET clause:

Call Chain

Impact

An authenticated attacker  can:

1. Modify any user's password — including the super administrator (except the built-in founder ucode=10001).
2. Alter account status — enable or disable arbitrary accounts.
3. Inject deeper SQL — the value parameter allows single-quote escape, potentially enabling stacked or tautology-based attacks.

This leads to account takeover and complete control of the CMS backend.

Reproduction Steps

Prerequisites

• PbootCMS V3.2.5 installed locally (tested on 192.168.1.104, Apache/PHP 7.2.1/SQLite)
• A valid backend admin account

Step 1: Login to Admin Panel

Access the PbootCMS admin dashboard and log in with the default admin account.

Step 2: Create a Target User

Navigate to System Management → User Management → Add User. Create a new user:

• Username: admin2
• Password: admin
• Role: System Administrator

Step 3: Verify User Exists

The user list confirms admin2 with ucode=10002:

Step 4: Confirm Initial Password

Open a new browser window. Attempt to log in as admin2 with password 123456 — this fails because the actual password is admin:

Step 5: Craft and Execute the Payload

Using the already-logged-in admin browser, navigate to:

14e1b600b1fd579f47433b88e8d85291 is the MD5 hash of 123456.

The mod() method executes the injection and redirects via location(-1):

Step 6: Verify Password Change

Now attempt to log in with admin2 / 123456:

The password has been successfully changed via SQL injection. The user is now logged in with the new password, confirming full account takeover.

Source Code Analysis

Vulnerable Code (UserController.php, line ~149)

Database Layer (Model.php - update method)

When update() receives a string argument, it is used as-is in the SET clause without any escaping:

Remediation

1. Whitelist validation on the field parameter — only allow known column names (status, username, realname, password).
2. Parameterized queries — use prepared statements instead of string concatenation.
3. Escape user input — at minimum, sanitize $value to prevent quote-breakout.
4. Force password hashing — if field is password, apply encrypt_string() to the value before storage.
5. Restrict the standalone-modify path — the "single field modify" branch in mod() should require a valid CSRF token and role-level authorization check.

References

• PbootCMS Official Website
• PbootCMS Source on Gitee
• CVE-2026-79387

Disclosure: This vulnerability was responsibly disclosed to the vendor. If you are running an affected version, update immediately and audit all backend accounts.