CVE-2023-39834

PbootCMS below 3.2.0 reaches attacker-controlled input to PHP's create_function, which compiles and runs code from a string — so a crafted request becomes command injection and arbitrary code execution on the web server. The vector is remote, unauthenticated, and needs no interaction: a single request to a vulnerable PbootCMS site hands over code execution in the web application's context.

Unauthenticated RCE in a content-management system is prime botnet fodder. CMS platforms are internet-facing by design and easy to fingerprint, so this is the profile that mass scanners hunt for and weaponize soon after disclosure, hitting every reachable install indiscriminately. Once code runs, the usual outcomes follow — web shells, SEO spam and defacement, cryptominers, or a pivot into the hosting environment behind the site.

Our first task is finding it. PbootCMS installs are self-managed and easy to lose track of, so we fingerprint the CMS across our web-facing footprint and pin versions against the 3.2.0 boundary. Where a vulnerable instance can't be upgraded immediately, request-level virtual patching to block the injection pattern buys time — but the durable fix is getting every install to 3.2.0 or later.