CVE-2009-2394

SMSPages 1.0 - SQL Injection via CatID Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-2394. PoCs published by SecurityRules.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in Messages Library v2.0's cat.php script. It uses a UNION-based SQLi to extract admin credentials (Modname and ModPassword) from the modretor table.

Description

SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by SecurityRules · textwebappsphp
https://www.exploit-db.com/exploits/9027

This exploit demonstrates a SQL injection vulnerability in Messages Library v2.0's cat.php script. It uses a UNION-based SQLi to extract admin credentials (Modname and ModPassword) from the modretor table.

Classification
Working Poc 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Messages Library v2.0
No auth needed
Prerequisites: Target must be running Messages Library v2.0 with vulnerable cat.php script
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9027

Scores

EPSS 0.0092
EPSS Percentile 55.8%

Details

CWE
CWE-89
Status published
Products (1)
smspages/smspages 1.0
Published Jul 09, 2009
Tracked Since Feb 18, 2026