CVE-2009-0738

Auth Php 1.0 - SQL Injection via Username or Passwd Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-0738. PoCs published by x0r.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in AuthPhp 1.0's login.php, allowing authentication bypass via a simple payload (' or '1=1). The vulnerability arises from unsanitized user input in the SQL query.

Description

SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by x0r · textwebappsphp

https://www.exploit-db.com/exploits/8033

View Code ZIP pw:eip

This exploit demonstrates an SQL injection vulnerability in AuthPhp 1.0's login.php, allowing authentication bypass via a simple payload (' or '1=1). The vulnerability arises from unsanitized user input in the SQL query.

Classification

Working Poc 100%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: AuthPhp 1.0

No auth needed

Prerequisites: Access to the login page of AuthPhp 1.0

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/8033

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33908

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/33723

Scores

EPSS 0.0114

EPSS Percentile 62.4%

Details

CWE

CWE-89

Status published

Products (1)

frankmancuso/auth_php 1.0

Published Feb 25, 2009

Tracked Since Feb 18, 2026