CVE-2009-2168

CRITICAL

EgyPlus 7ammel <1.0.1 - Auth Bypass

Title source: llm

Description

cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied credentials are incorrect, which allows remote attackers to bypass authentication by providing arbitrary username and password parameters.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Qabandi · textwebappsphp

https://www.exploit-db.com/exploits/8865

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/8865

Scores

CVSS v3 9.8

EPSS 0.0110

EPSS Percentile 77.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-287

Status draft

Affected Products (1)

egyplus/7ammel < 1.0.1

Timeline

Published Jun 22, 2009

Tracked Since Feb 18, 2026