Empire CMS 47 - SQL Injection

ExploitDBExploitDB exploitExploitEDB-10069

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

PHP script that sends a crafted HTTP POST request to Empire CMS 47 to exploit a SQL injection vulnerability in the CLIENT-IP header, extracting admin credentials (username, password, rnd) from the phome_enewsuser table.

Backdoor review

No backdoor observed in reviewed code

The supplied PHP script is a straightforward proof-of-concept for CVE-2009-2269. It constructs a single HTTP POST request to exploit a SQL injection vulnerability in Empire CMS 5.1 by injecting a crafted SQL payload into the CLIENT-IP header. The script prints informational banners, sends the request, and outputs the server response. No backdoor, secondary payload, persistence mechanism, or deceptive behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesphp
Target softwareEmpire CMS 47
Attack typesSQL injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious HTTP request containing a crafted SQL injection payload to extract sensitive data from the target database, which constitutes exploitation rather than mere detection or scanning.

exploits/php/webapps/10069.php:27-28exploits/php/webapps/10069.php:41-48

Requirements

  • Target must be running Empire CMS 47 with the vulnerable e/tool/gbook/ component accessible.exploits/php/webapps/10069.php:5
  • PHP >= 5 and MySQL >= 4.1 required on the target server for the SQL injection payload to work.exploits/php/webapps/10069.php:9

Observed behavior

  • Script constructs a SQL injection payload that extracts the admin username, password, and rnd value from the phome_enewsuser table via a subquery in the CLIENT-IP header.exploits/php/webapps/10069.php:27-28
  • Script opens a socket to the target host on port 80 and sends a crafted HTTP POST request to /e/enews/index.php with the SQL injection payload in the CLIENT-IP header.exploits/php/webapps/10069.php:29-48
  • Script instructs the user to visit the guestbook page (e/tool/gbook/?bid=1) to view the extracted admin hash.exploits/php/webapps/10069.php:54
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Sql Injection Payload
aaaaaaaa',0,1,''),('t00lsxxxx','t00lsxxxxx','','2008-05-28 15:44:17',(select concat(username,0x5f,password,0x5f,rnd) from phome_enewsuser where userid=1),'',1,'1111',0,0,'')/*The script injects this SQL payload into the CLIENT-IP header to extract admin credentials from the phome_enewsuser table. This is the documented exploit behavior for CVE-2009-2269.exploits/php/webapps/10069.php:27-28
Network Connection
fsockopen($host,80)The script opens a TCP connection to the target host on port 80 to deliver the exploit payload. This is the expected behavior for a web application exploit.exploits/php/webapps/10069.php:41
Output Instruction
echo "[+]go to http://$host$path/e/tool/gbook/?bid=1 see the hash"The script instructs the operator to manually visit a URL to view the extracted password hash, which is a common post-exploitation step in SQL injection PoCs.exploits/php/webapps/10069.php:54
Review boundaries

What the analysis did not establish

  • Evidence is limited to the single PHP script; no external libraries, tools, or referenced resources are included.
  • The script's actual execution, reliability, or safety is not verified; only the source code is analyzed.
  • Only the single PHP file (exploitdb/exploits/php/webapps/10069.php) was reviewed. No external resources, libraries, or network content fetched by the script were inspected.
  • The script's output instruction (line 54) directs the operator to manually visit a URL, which could potentially expose the operator to client-side attacks if the target server is compromised, but this is not a behavior of the script itself.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1