CVE-2009-4561
WebLeague 2.2.0 - SQL Injection via Username or Password Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-4561. PoCs published by ka0x.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in WebLeague 2.2.0, allowing an attacker to bypass admin authentication by injecting malicious SQL syntax into the username and password fields. The PoC sends a crafted POST request to the admin login page, exploiting the lack of input sanitization.
Description
Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Exploits (1)
This exploit demonstrates an SQL injection vulnerability in WebLeague 2.2.0, allowing an attacker to bypass admin authentication by injecting malicious SQL syntax into the username and password fields. The PoC sends a crafted POST request to the admin login page, exploiting the lack of input sanitization.