A critical vulnerability in PbootCMS v.3.2.15 allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk of full system compromise.

This vulnerability involves improper handling of user input within the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components. An unauthenticated attacker can leverage these flaws to execute arbitrary code over the network.

The CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for full remote code execution without requiring any user interaction or authentication. Successful exploitation grants an attacker complete control over the host server, leading to potential data theft, unauthorized modification of website content, and the installation of persistent backdoors. This poses a significant threat to operational integrity and data confidentiality.

Immediate Action: Upgrade PbootCMS to a version newer than 3.2.15 as specified in the vendor advisory.

Proactive Monitoring: Review web server access logs for suspicious requests targeting controller files or unusual input strings that may indicate injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to filter malicious payloads targeting the identified controller files, and ensure the application runs with the least privilege necessary to limit potential damage.

Public Exploit Available: No (There is no confirmed public exploit available according to current data).

Given the critical severity and the potential for total system compromise, organizations running PbootCMS v.3.2.15 must prioritize remediation. Apply the necessary vendor-provided updates immediately to eliminate this remote code execution vector and protect the underlying infrastructure from unauthorized access.