CVE-2009-0710
PHPFootball 1.6 - Cross-Site Scripting via User or DBField Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-0710.
AI-analyzed exploit summary This exploit targets a hash disclosure vulnerability in PHPFootball <= 1.6 by sending a crafted HTTP request to the 'filter.php' endpoint, which leaks user password hashes from the 'Accounts' table. The script parses the response to extract the disclosed hashes.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PHPFootball 1.6 allow remote attackers to inject arbitrary web script or HTML via (1) the user parameter to login.php or (2) the dbfield parameter to filter.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (1)
This exploit targets a hash disclosure vulnerability in PHPFootball <= 1.6 by sending a crafted HTTP request to the 'filter.php' endpoint, which leaks user password hashes from the 'Accounts' table. The script parses the response to extract the disclosed hashes.