CVE-2026-79387: PbootCMS SQL Injection Vulnerability

CVE-2026-79387 Overview

CVE-2026-79387 is a SQL injection vulnerability affecting PbootCMS versions 3.2.0 through 3.2.5. The flaw resides in the User/mod interface, which fails to properly sanitize user-supplied parameters before incorporating them into SQL statements. An authenticated attacker can craft malicious input to modify arbitrary user account fields, including passwords and role assignments. Successful exploitation results in full account takeover, including elevation to administrative accounts. The vulnerability requires prior authentication but no elevated privileges, making low-privileged accounts a viable staging point for compromise of higher-privileged users.

Critical Impact

Authenticated attackers can rewrite passwords and role fields of any user, including administrators, leading to complete compromise of the CMS instance.

Affected Products

• PbootCMS 3.2.0
• PbootCMS 3.2.1 through 3.2.4
• PbootCMS 3.2.5

Discovery Timeline

• 2026-09-09 - CVE-2026-79387 published to the National Vulnerability Database (NVD)
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79387

Vulnerability Analysis

The vulnerability exists in the User/mod interface of PbootCMS, a PHP-based content management system. The endpoint accepts parameters intended to update the currently authenticated user's profile fields. However, the handler concatenates untrusted request parameters directly into an SQL UPDATE statement without adequate parameterization or field allow-listing.

Because the parameter names themselves influence which columns are updated, an attacker can inject additional column assignments beyond the intended scope. This allows overwriting sensitive columns such as password hashes and role identifiers on records the attacker does not own. The condition maps to [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is missing input validation and unsafe query construction in the profile-modification handler. The application trusts client-supplied field names and values, and it does not verify that the target record belongs to the calling user. This combination of injection and broken access control turns a profile-update feature into an arbitrary account rewrite primitive.

Attack Vector

An attacker first authenticates to the PbootCMS instance with any valid account, including a self-registered low-privileged user. The attacker then submits a crafted request to the User/mod endpoint that includes injected column names or SQL fragments targeting the users table. By setting the target record identifier and password or role column, the attacker can seize control of an administrator account and pivot to full CMS control. Refer to the published proof-of-concept in the GitHub PoC repository for CVE-2026-79387 for the exact parameter structure.

Detection Methods for CVE-2026-79387

Indicators of Compromise

• Unexpected POST requests to the User/mod endpoint containing SQL metacharacters such as single quotes, comment sequences, or UPDATE/SET keywords in parameter names or values.
• Password hash or role column changes on user records that do not correspond to legitimate password reset or administrator activity in application logs.
• New administrator sessions originating from IP addresses previously associated only with low-privileged accounts.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect PbootCMS User/mod requests for unexpected parameter names and SQL syntax tokens.
• Enable database query logging and alert on UPDATE statements against the users table that modify password or role columns outside of documented administrative workflows.
• Correlate authentication events with subsequent privilege changes to surface accounts that elevate role assignments shortly after login.

Monitoring Recommendations

• Forward PbootCMS web server access logs and database audit logs to a centralized analytics platform for retention and correlation.
• Baseline normal request patterns for /User/mod and alert on parameter cardinality spikes or previously unseen field names.
• Monitor for lateral session activity where a session token issued to a standard user begins accessing administrator-only routes.

How to Mitigate CVE-2026-79387

Immediate Actions Required

• Restrict access to the PbootCMS admin panel and User/mod endpoint at the network layer until a vendor patch is applied.
• Force a password reset for all user accounts and audit the users table for unauthorized role changes.
• Disable open self-registration to reduce the population of attackers who can reach the authenticated endpoint.

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Monitor the PbootCMS official website for a security release addressing versions 3.2.0 through 3.2.5, and upgrade as soon as a patched build is available.

Workarounds

• Apply WAF signatures that reject requests to User/mod containing unexpected parameter names, SQL comment tokens, or role and password column identifiers.
• Implement server-side allow-listing of updatable profile fields in a custom patch, rejecting any request that references columns outside the approved set.
• Enforce record ownership checks so that update queries include a WHERE user_id = <session_user> predicate that cannot be overridden by client input.