CVE-2009-1503

TigerDMS - SQL Injection via Login Username and Password Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-1503. PoCs published by ThE g0bL!N.

AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in Tiger DMS's login.php, allowing authentication bypass via crafted input. The PoC uses a classic SQLi payload to bypass authentication by manipulating the WHERE clause.

Description

Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED
by ThE g0bL!N · textwebappsphp
https://www.exploit-db.com/exploits/8571

This exploit demonstrates an SQL injection vulnerability in Tiger DMS's login.php, allowing authentication bypass via crafted input. The PoC uses a classic SQLi payload to bypass authentication by manipulating the WHERE clause.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Tiger DMS (version unspecified)
No auth needed
Prerequisites: Access to the login page · SQL injection vulnerability in the target application
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/8571
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34784
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34775

Scores

EPSS 0.0101
EPSS Percentile 58.6%

Details

CWE
CWE-89
Status published
Products (1)
tigerdms/tigerdms
Published May 01, 2009
Tracked Since Feb 18, 2026