CVE-2009-0458

Whole Hog Ware Support 1.x - SQL Injection

Title source: llm

Description

Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.

Exploits (2)

exploitdb WRITEUP VERIFIED

by ByALBAYX · textwebappsphp

https://www.exploit-db.com/exploits/7940

View Code ZIP pw:eip

exploitdb WORKING POC

webappsphp

https://www.exploit-db.com/exploits/7941

View Code ZIP pw:eip

References (4)

[Third Party Advisory, VDB Entry] http://osvdb.org/51733

[Vendor Advisory] http://secunia.com/advisories/33777

[Exploit] http://www.securityfocus.com/bid/33564

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/7940

Scores

EPSS 0.0034

EPSS Percentile 56.3%

Details

CWE

CWE-89

Status published

Products (1)

wholehogsoftware/ware_support 1.0

Published Feb 10, 2009

Tracked Since Feb 18, 2026