PbootCMS SQL Injection Vulnerability in Template Parsing

A SQL injection vulnerability has been identified in PbootCMS version 1.4.1. This issue arises from the improper parsing of 'if' statements in templates, allowing malicious users to inject harmful content into templates. The vulnerability is triggered when the application uses 'eval' statements to process these templates, potentially leading to code execution.

Impact

Exploitation of this vulnerability allows for SQL injection, with the possibility of executing arbitrary code through the injected payloads.

Reproduction

To reproduce this vulnerability, upload a template that includes a 'pboot:if' statement. The injected content can be crafted to include SQL injection payloads. Once the template is processed, the 'eval' function will execute the injected SQL code, exploiting the vulnerability.

Remediation

Users are advised to update to PbootCMS version 4.2, which addresses this vulnerability.