CVE-2009-1281

glFusion < 1.1.3 - Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1281.

AI-analyzed exploit summary This PHP script exploits a blind SQL injection vulnerability in glFusion <= 1.1.2 via the COM_applyFilter() function in session handling. It uses time-based delays to extract admin hashes from the database by injecting malicious SQL queries through the session cookie.

Description

Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploits (1)

exploitdb WORKING POC
phpwebappsphp
https://www.exploit-db.com/exploits/8347

This PHP script exploits a blind SQL injection vulnerability in glFusion <= 1.1.2 via the COM_applyFilter() function in session handling. It uses time-based delays to extract admin hashes from the database by injecting malicious SQL queries through the session cookie.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: glFusion <= 1.1.2
Auth required
Prerequisites: Valid user credentials · MySQL >= 5.0.12 with SLEEP() function · Session ID not MD5-hashed in configuration
mistral-large-3 · analyzed Feb 19, 2026 Full analysis →

References (4)

Core 4
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34575
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34377
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/53287
Patch, Vendor Advisory x_refsource_confirm
http://www.glfusion.org/article.php/glfusion113

Scores

EPSS 0.0149
EPSS Percentile 71.6%

Details

CWE
CWE-79
Status published
Products (5)
glfusion/glfusion 1.0.0
glfusion/glfusion 1.0.1
glfusion/glfusion 1.1.0
glfusion/glfusion 1.1.1
glfusion/glfusion < 1.1.2
Published Apr 09, 2009
Tracked Since Feb 18, 2026