CVE-2020-19248

SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by searching for page contamination URLs, thus triggering vulnerabilities when the program uses eval statements to parse templates.

CVSS v3.1

5.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 17th percentile

Published

2025-02-21

Proof-of-concept exploits (1)

• https://unh3x.github.io/2019/07/19/PbootCMSv1.4.1_Template_Injection/

References

• CVE Record
• NVD entry

Related

• CVE-2020-1920
• CVE-2020-19263
• CVE-2020-19199
• CVE-2020-19264
• CVE-2020-19190
• CVE-2020-19265