PbootCMS is vulnerable to an unauthenticated SQL injection attack in the member login module, which allows remote attackers to bypass authentication and compromise user accounts.

This is a SQL injection vulnerability (CWE-89) triggered by the improper neutralization of the username parameter within the checkUsername function. The vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious SQL commands to manipulate database queries.

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms, granting them unauthorized access to any frontend member account. This poses a severe risk of data exposure, potential account takeover, and unauthorized access to member-restricted content, which may lead to significant reputational damage and loss of user trust. While the CVSS score is 7.3, the ability for unauthenticated remote code execution or authentication bypass often carries higher operational risk than the score suggests.

Immediate Action: Since a specific patch version is currently unknown, administrators should implement strict input validation on the login endpoint and consider disabling member registration or login functions if they are not business-critical until a vendor-supplied update is released.

Proactive Monitoring: Review web server and application logs for anomalous POST requests to the /member/login endpoint, specifically looking for SQL-related characters such as single quotes, dashes, or SQL keywords like UNION and OR in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing common SQL injection patterns in the username parameter to prevent exploitation attempts.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the security researcher in the referenced GitHub repository.

Given the availability of a functional proof-of-concept and the ease of exploitation, this vulnerability should be treated with high urgency. Organizations using PbootCMS should immediately implement WAF protections and monitor for suspicious login attempts while actively tracking the vendor for a security update to address the underlying code flaw.