CVE-2009-2734

Achievo 1.3.4 - SQL Injection

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-2734 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.

Description

SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBAchievo 1.3.4 - SQL InjectionExploitDB exploitby Ryan DewhurstWriteup1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a security advisory describing an SQL injection vulnerability in Achievo 1.3.4. It provides a technical description of the vulnerable code in classweekreport.inc and a URL demonstrating how to trigger a syntax error, but it does not include any executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard security advisory describing an SQL injection vulnerability in Achievo 1.3.4. It includes a technical description, a proof-of-concept URL, and the vulnerable code snippet. No backdoor, deceptive payload, or unrelated harmful behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesenglish
Target softwareAchievo
Attack typessql injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a security advisory containing a technical description of the vulnerability and a proof-of-concept URL that triggers an error, but it does not contain any code intended to exploit or scan for the vulnerability. It is a writeup.

exploits/php/webapps/10042.txt:1-126

Requirements

  • Attacker must be logged into Achievo.exploits/php/webapps/10042.txt:66

Observed behavior

  • The advisory describes a SQL injection vulnerability in the get_employee function of classweekreport.inc, where the $user_id variable is directly embedded in a SQL query without sanitization.exploits/php/webapps/10042.txt:73-80
  • The advisory provides a URL that triggers a database syntax error when browsed by a logged-in user, demonstrating the vulnerability.exploits/php/webapps/10042.txt:68-70
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
Payload withheldThe advisory describes a legitimate SQL injection vulnerability (CVE-2009-2734) in the get_employee function of classweekreport.inc. The provided PoC URL demonstrates the vulnerability by injecting a single quote into the userid parameter.exploits/php/webapps/10042.txt:64-80
Proof Of Concept Url
Payload withheldThe URL demonstrates the SQL injection by setting userid to a single quote, which would cause a syntax error in the vulnerable SQL query. This is a typical benign PoC for demonstrating SQL injection existence.exploits/php/webapps/10042.txt:68
Vulnerable Code
Payload withheldThe advisory shows the vulnerable code where the $user_id variable is directly interpolated into the SQL query without sanitization, confirming the SQL injection vulnerability.exploits/php/webapps/10042.txt:73-80
Review boundaries

What the analysis did not establish

  • The artifact is a text advisory; no executable exploit or scanner code is present.
  • The advisory references an external URL for the full advisory, which was not fetched.
  • Only the text content of the advisory was reviewed; no external resources or referenced URLs were fetched or analyzed.
  • The review does not assess whether the described vulnerability could be used maliciously by a third party.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

8