CVE-2026-79387

PbootCMS versions 3.2.0 through 3.2.5 contain a SQL injection flaw in the User/mod interface used for editing user accounts. An authenticated user can send crafted parameters to that endpoint, and the injection lets the request write to arbitrary user account fields rather than only the intended ones. By modifying another account's password or role, the attacker can take over higher-privileged accounts, including administrators. Any site running PbootCMS 3.2.0-3.2.5 is affected, with exploitation requiring an authenticated session on the CMS. The flaw has a public proof-of-concept on GitHub, but it is not yet in CISA KEV, has no CVSS score, and there are no confirmed reports of in-the-wild exploitation.

What to do: Upgrade to the latest PbootCMS release newer than 3.2.5 (check the project's GitHub for the current fixed version, as none is specified in the advisory data). Until patched, restrict access to the admin User/mod interface to trusted accounts, apply least-privilege to CMS user roles, and review recent account changes for unexpected password or role modifications. Use the referenced public proof-of-concept as a reference for building detection rules in WAF or logging pipelines.