PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html related to the parserIfLabel function in \\apps\\home\\controller\\ParserController.php.