CVE-2026-4510

Root

Cause A weakness in PbootCMS up to version 3.2.12 allows a malicious actor to supply a crafted backurl parameter to the member login endpoint. The alert_location() function in core/function/helper.php directly embeds this user-controlled value into a JavaScript string assigned to location.href, without context-aware output encoding. The vulnerable code path is located in apps/home/controller/MemberController.php [1].

Attack

Surface An unauthenticated attacker can exploit this by sending a victim a link to /member/login?backurl=... with a specially crafted value. Because the backurl is inserted into a JavaScript context without escaping special characters like double quotes and semicolons, the attacker can break out of the string and inject arbitrary JavaScript. This is a reflected (non-persistent) attack that requires user interaction (clicking the crafted link) [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the context of the PbootCMS site. This can be used to steal session cookies, perform phishing by redirecting the victim to a malicious site (open redirect), or deface the page. The reference report classifies this as CWE-79 (Cross-Site Scripting) and CWE-601 (URL Redirection to Untrusted Site), assigning a CVSS v3 base score of 6.1 (Medium/High) [1].

Mitigation

At the time of disclosure, no official patch has been released for PbootCMS 3.2.12. Administrators should sanitize the backurl parameter by validating it against a whitelist of allowed hosts and encoding the output for the JavaScript context. Until a vendor fix is available, upgrading to a newer version or applying a web application firewall (WAF) rule that blocks malicious payloads in the backurl parameter is recommended [1].