EUVD-2025-28029
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information via a crafted GET request
Analysis
SQL Injection vulnerability in pbootCMS versions 3.2.5 and 3.2.10 that allows unauthenticated remote attackers to execute arbitrary SQL queries via crafted GET requests, potentially leading to unauthorized data disclosure, modification, or system compromise. With a CVSS score of 8.8 and network-accessible attack vector requiring only user interaction, this represents a critical threat to publicly exposed pbootCMS installations. The vulnerability's high impact on confidentiality, integrity, and availability suggests potential for large-scale exploitation if proof-of-concept code becomes available.
Technical Context
SQL Injection (CWE-89) represents a fundamental input validation failure where untrusted user input is concatenated into SQL query construction without proper parameterization or prepared statement usage. In pbootCMS, the vulnerability likely exists in GET request parameter handling where query strings are passed directly to database operations. pbootCMS (CPE: cpe:2.3:a:pbootcms:pbootcms) is a PHP-based content management system; the affected versions 3.2.5 and 3.2.10 indicate the vulnerability spans multiple recent releases, suggesting either a shared code path or incomplete patching between versions. The GET-based attack vector indicates the injection point is exposed through standard HTTP query parameters, making exploitation trivial from a technical complexity perspective and requiring no special authentication or privileges.
Affected Products
pbootCMS (['3.2.5', '3.2.10'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today