CVE-2009-2231

MIDAS 1.43 - Unauthenticated Authentication Bypass via Admin Cookie

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-2231. PoCs published by HxH.

AI-analyzed exploit summary This exploit leverages insecure cookie handling in MIDAS to bypass authentication by setting a crafted cookie with admin privileges. The attacker can then access the admin panel directly.

Description

MIDAS 1.43 allows remote attackers to bypass authentication and obtain administrative access via an admin account record in a MIDAS cookie.

Exploits (1)

exploitdb WORKING POC VERIFIED
by HxH · textwebappscgi
https://www.exploit-db.com/exploits/8987

This exploit leverages insecure cookie handling in MIDAS to bypass authentication by setting a crafted cookie with admin privileges. The attacker can then access the admin panel directly.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: MIDAS (version not specified)
No auth needed
Prerequisites: Access to the target's web interface · JavaScript execution context (e.g., browser console)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/51281
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/8987
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/1646

Scores

EPSS 0.0263
EPSS Percentile 83.6%

Details

CWE
CWE-287
Status published
Products (1)
mid.as/midas 1.43
Published Jun 26, 2009
Tracked Since Feb 18, 2026