PT-2025-7275 · Pbootcms · Pbootcms

Stick.Wang · Published 2025-02-21 · Updated 2025-02-22 · CVE-2020-19248

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PbootCMS version 1.4.1

Description The issue allows a malicious user to contaminate template content by searching for page contamination URLs, thus triggering vulnerabilities when the program uses eval statements to parse templates. This is due to a SQL Injection vulnerability in parsing if statements in templates.

Recommendations For PbootCMS version 1.4.1, consider disabling the use of eval statements in template parsing until a patch is available. Restrict access to template content to minimize the risk of exploitation. Avoid using contaminated URLs in the affected templates until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-19248

Affected Products

Pbootcms

References · 7

• 🔥 https://unh3x.github.io/2019/07/19/PbootCMSv1.4.1_Template_Injection · Exploit
• https://osv.dev/vulnerability/CVE-2020-19248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19248 · Security Note
• https://t.me/cvedetector/18690 · Telegram Post
• https://twitter.com/CVEnew/status/1893010754552422844 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1893091485903466824 · Twitter Post
• https://github.com/SticKManII/SticKManII.github.io/tree/master/2019/07/31/PbootCMSv1-4-1-%E5%89%8D%E5%8F%B0%E6%90%9C%E7%B4%A2%E9%A1%B5%E9%9D%A2%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5 · Note