CVE-2026-92383 in PbootCMS
Summary
by MITRE • 09/17/2026
A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the file apps/admin/controller/system/UserController.php of the component User Management. Such manipulation leads to cross-site request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 3.2.25 is able to resolve this issue. The name of the patch is c25241a0964742cefb7f698efbb6c38b868d6ff7. It is advisable to upgrade the affected component.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The identified security flaw resides within the PbootCMS content management system, specifically affecting versions up through 3.2.24. The vulnerability impacts the User Management component by compromising the integrity of user account operations performed via the UserController class. Specifically, the functions responsible for deleting and modifying user accounts, located in the file apps/admin/controller/system/UserController.php, lack sufficient validation mechanisms to distinguish between legitimate administrative requests and maliciously crafted ones initiated from external sources. This deficiency allows an attacker to exploit cross-site request forgery techniques to force authenticated administrators into executing unintended actions without their knowledge or consent.
Cross-site request forgery represents a significant threat vector in web applications because it leverages the trust that a site has in a user's browser and session credentials. In this specific context, if an administrator is logged into the PbootCMS administrative panel while visiting a maliciously constructed webpage, the attacker can embed hidden requests targeting the UserController endpoints. When the administrator interacts with the legitimate application or simply loads the page, their browser automatically includes valid authentication cookies in these forged requests. Consequently, actions such as deleting critical user accounts or modifying system configurations are executed under the guise of an authorized administrative action, bypassing standard access controls that rely solely on session validity rather than request origin verification.
The operational impact of this vulnerability is severe due to its potential for remote exploitation and public disclosure of exploit code. An attacker with no prior authentication can potentially disrupt service availability by deleting essential user accounts required for system maintenance or further administrative tasks. Furthermore, the ability to modify user data introduces risks related to privilege escalation if an attacker alters permissions associated with existing accounts or creates backdoor users with elevated privileges. The presence of publicly available exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of successful attacks against unpatched instances in production environments where administrators may not be fully aware of CSRF protections required by modern web standards.
From a classification perspective, this vulnerability aligns with CWE-352, which defines cross-site request forgery as a weakness allowing an attacker to send unauthorized commands to a vulnerable application on behalf of a authenticated user. Additionally, the attack technique maps to MITRE ATT&CK tactic T1078, specifically relating to valid accounts and potential misuse for persistence or privilege escalation within enterprise environments. The lack of anti-CSRF tokens in these specific controller methods violates fundamental security design principles that mandate state-changing operations require explicit confirmation mechanisms independent of session cookies.
To mitigate this risk immediately, organizations running PbootCMS versions prior to 3.2.25 must upgrade the software to version 3.2.25 or later. This update incorporates a patch identified by commit hash c25241a0964742cefb7f698efbb6c38b868d6ff7, which addresses the underlying logic flaw in the UserController methods. Until an upgrade is feasible, administrators should implement network-level controls such as restricting access to the administrative interface via IP whitelisting or requiring multi-factor authentication for all admin sessions to reduce the window of opportunity for exploitation. Additionally, reviewing web server configurations to enforce strict Content Security Policy headers can help mitigate some aspects of CSRF by limiting which origins are permitted to submit forms to the application domain.