CVE-2009-3327

WX-Guestbook 1.1.208 - SQL Injection via QUERY or USERNAME Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3327. PoCs published by learn3r.

AI-analyzed exploit summary This is a technical writeup detailing SQL injection and persistent XSS vulnerabilities in WX Guestbook 1.1.208. It includes specific exploit strings for SQLi and XSS, along with a root cause analysis of unsanitized input.

Description

Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow remote attackers to execute arbitrary SQL commands via the (1) QUERY parameter to search.php and (2) USERNAME parameter to login.php. NOTE: some of these details are obtained from third party information.

Exploits (1)

exploitdb WRITEUP VERIFIED

by learn3r · textwebappsmultiple

https://www.exploit-db.com/exploits/9730

View Code ZIP pw:eip

This is a technical writeup detailing SQL injection and persistent XSS vulnerabilities in WX Guestbook 1.1.208. It includes specific exploit strings for SQLi and XSS, along with a root cause analysis of unsanitized input.

Classification

Writeup 90%

Attack Type

Sqli | Xss | Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: WX Guestbook 1.1.208

No auth needed

Prerequisites: Access to the search.php endpoint · Access to the login page · Ability to submit guestbook entries

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Core References

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36806

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9730

Scores

EPSS 0.0093

EPSS Percentile 55.8%

Details

CWE

CWE-89

Status published

Products (1)

webilix/wx-guestbook 1.1.208

Published Sep 23, 2009

Tracked Since Feb 18, 2026