Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-2606. PoCs published by ByALBAYX.
AI-analyzed exploit summary This exploit targets ASP Football Pool v2.3 by directly accessing the exposed database file (NFL.mdb) via a predictable path. It uses LWP::UserAgent to fetch the database and save it locally.
Description
ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for NFL.mdb.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by ByALBAYX · pythonwebappsphp
https://www.exploit-db.com/exploits/8852
This exploit targets ASP Football Pool v2.3 by directly accessing the exposed database file (NFL.mdb) via a predictable path. It uses LWP::UserAgent to fetch the database and save it locally.
Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target:
ASP Football Pool v2.3
No auth needed
Prerequisites:
Target must have the database file accessible at the default path
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (2)
Core 2
Core References
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/8852
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/35317
Scores
EPSS
0.0223
EPSS Percentile
80.4%
Details
CWE
CWE-264
Status
published
Products (1)
brainjar/asp_football_pool
2.3
Published
Jul 27, 2009
Tracked Since
Feb 18, 2026