CVE-2009-2402

PHPEcho CMS <2.0-rc3 - SQL Injection

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-2402. PoCs published by JosS.

AI-analyzed exploit summary This exploit demonstrates XSS and blind SQL injection vulnerabilities in PHPEcho CMS 2.0-rc3. The XSS allows cookie theft via injected JavaScript, while the blind SQLi enables database enumeration through boolean-based queries.

Description

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355.

Exploits (1)

exploitdb WORKING POC VERIFIED

by JosS · textwebappsphp

https://www.exploit-db.com/exploits/9014

View Code ZIP pw:eip

This exploit demonstrates XSS and blind SQL injection vulnerabilities in PHPEcho CMS 2.0-rc3. The XSS allows cookie theft via injected JavaScript, while the blind SQLi enables database enumeration through boolean-based queries.

Classification

Working Poc 90%

Attack Type

Xss | Sqli

Complexity

Trivial

Reliability

Reliable

Target: PHPEcho CMS 2.0-rc3

No auth needed

Prerequisites: Access to the forum module of the target application

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9014

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/35488

Scores

EPSS 0.0095

EPSS Percentile 56.6%

Details

CWE

CWE-89

Status published

Products (1)

phpecho_cms/phpecho_cms 2.0-rc3

Published Jul 09, 2009

Tracked Since Feb 18, 2026