CVE-2009-4551

Miniweb 2.0 - SQL Injection via Survey Pro Campaign ID Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-4551. PoCs published by Moudi.

AI-analyzed exploit summary This is a writeup detailing blind SQL injection and XSS vulnerabilities in Miniweb 2.0 Survey Pro module. It provides example URLs demonstrating the vulnerabilities but does not include functional exploit code.

Description

SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to index.php.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Moudi · textwebappsphp

https://www.exploit-db.com/exploits/9339

View Code ZIP pw:eip

This is a writeup detailing blind SQL injection and XSS vulnerabilities in Miniweb 2.0 Survey Pro module. It provides example URLs demonstrating the vulnerabilities but does not include functional exploit code.

Classification

Writeup 90%

Attack Type

Sqli | Xss

Complexity

Trivial

Reliability

Theoretical

Target: Miniweb 2.0 Survey Pro module

No auth needed

Prerequisites: Access to the vulnerable web application

MITRE ATT&CK

T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/9339

Exploit vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/35870

Scores

EPSS 0.0091

EPSS Percentile 55.1%

Details

CWE

CWE-89

Status published

Products (1)

intesync/miniweb 2.0

Published Jan 04, 2010

Tracked Since Feb 18, 2026