PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of \eval\ with mixed case as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GETa))}1{/pboot:if}&a=phpinfo(); URI because of an incorrect apps\\home\\controller\\ParserController.php parserIfLabel protection mechanism.