CVE-2009-3330

cP Creator 2.7.1 - SQL Injection via Support Ticket Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3330. PoCs published by Sina Yazdanmehr.

AI-analyzed exploit summary This exploit targets a SQL injection vulnerability in cP Creator v2.7.1 by injecting a malicious SQL query via the 'tickets' cookie to extract user credentials from the 'cp_staff' table.

Description

SQL injection vulnerability in index.php in cP Creator 2.7.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tickets parameter in a support ticket action.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Sina Yazdanmehr · pythonwebappsmultiple

https://www.exploit-db.com/exploits/9726

View Code ZIP pw:eip

This exploit targets a SQL injection vulnerability in cP Creator v2.7.1 by injecting a malicious SQL query via the 'tickets' cookie to extract user credentials from the 'cp_staff' table.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: cP Creator v2.7.1

No auth needed

Prerequisites: Magic Quotes gpc = Off · Target application must be cP Creator v2.7.1

MITRE ATT&CK

T1189 - Drive-by Compromise T1505 - Server Software Component

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/36815

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9726

Scores

EPSS 0.0085

EPSS Percentile 53.4%

Details

CWE

CWE-89

Status published

Products (1)

cpecreator/cp_creator 2.7.1

Published Sep 23, 2009

Tracked Since Feb 18, 2026