CVE-2020-19248

MEDIUM

5.1

Descripcion

SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by searching for page contamination URLs, thus triggering vulnerabilities when the program uses eval statements to parse templates.

Detalles CVE

Puntuacion CVSS v3.15.1

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Vector de ataqueLOCAL

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado2/21/2025

Ultima modificacion4/7/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

pbootcms:pbootcms

Debilidades (CWE)

CWE-89

Referencias

https://github.com/SticKManII/SticKManII.github.io/tree/master/2019/07/31/PbootCMSv1-4-1-%E5%89%8D%E5%8F%B0%E6%90%9C%E7%B4%A2%E9%A1%B5%E9%9D%A2%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5(cve@mitre.org)

https://unh3x.github.io/2019/07/19/PbootCMSv1.4.1_Template_Injection/(cve@mitre.org)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.