Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-3965. PoCs published by Bgh7.
AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in New5starRating v1.0's rating.php. The PoC uses a UNION-based SQLi to extract admin credentials (userid and userpass) from the database.
Description
SQL injection vulnerability in rating.php in New 5 star Rating 1.0 allows remote attackers to execute arbitrary SQL commands via the det parameter.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Bgh7 · textwebappsphp
https://www.exploit-db.com/exploits/9499
This exploit demonstrates a SQL injection vulnerability in New5starRating v1.0's rating.php. The PoC uses a UNION-based SQLi to extract admin credentials (userid and userpass) from the database.
Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target:
New5starRating v1.0
No auth needed
Prerequisites:
Target application must be running New5starRating v1.0 · rating.php must be accessible
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (1)
Core 1
Core References
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/9499
Scores
EPSS
0.0105
EPSS Percentile
59.9%
Details
CWE
CWE-89
Status
published
Products (1)
maniacomputer/new5starrating
1.0
Published
Nov 18, 2009
Tracked Since
Feb 18, 2026