The vulnerability resides in the checkUsername function of PbootCMS’s MemberController, allowing an attacker to manipulate the Username parameter and inject arbitrary SQL. This flaw enables a remote attacker to bypass authentication, read, modify, or delete database records, and potentially gain full control over application data. The weakness is a classic SQL Injection, identified by CWE-74 and CWE-89, which directly compromises confidentiality and integrity of the database.

PbootCMS versions up to 3.2.12 are affected. The vulnerability occurs in the Member Login component of the applications located in apps/home/controller/MemberController.php.

The CVSS score of 6.9 indicates a medium severity. The exploit is publicly available, meaning it can be accessed over the network without specialized infrastructure. EPSS data is not provided, and the vulnerability is not listed in CISA’s KEV catalog, but the remote nature and public availability increase the practical risk. The attacker would need only a crafted request to the login endpoint to exploit the flaw.