PbootCMS versions 3.2.0 through 3.2.5 contain a SQL injection flaw that can be triggered by an authenticated user using the User/mod interface. By crafting input parameters, an attacker can modify arbitrary fields of any user account, including passwords and roles, effectively enabling account takeover and privilege escalation. The primary impact is the loss of confidentiality and integrity of user credentials and the potential to gain full administrative control over the CMS.

The vulnerability affects the PbootCMS content management system, specifically versions 3.2.0 to 3.2.5. No vendor name is provided by the CNA, but the affected product is the PbootCMS web application. An authenticated user must be able to access the User/mod interface to exploit the flaw.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is unknown. However, the ability to change passwords and roles implies that the vulnerability could yield complete administrative access. Although the attacker must be authenticated, once the account is compromised or an existing user is granted sufficient privileges, the impact is severe. The risk should be considered high due to the potential for account takeover and subsequent system compromise.