CVE-2009-4596

PHP Inventory 1.2 - Cross-Site Scripting via sup_id Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-4596. PoCs published by mr_me.

AI-analyzed exploit summary The document describes an authentication bypass and SQL injection vulnerability in PHP Inventory v1.2, including specific payloads for SQLi and reflected XSS. It provides technical details on how to exploit the flaws but does not include functional exploit code.

Description

Cross-site scripting (XSS) vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary web script or HTML via the sup_id parameter in a suppliers details action.

Exploits (1)

exploitdb WRITEUP VERIFIED

by mr_me · textwebappsphp

https://www.exploit-db.com/exploits/10370

View Code ZIP pw:eip

The document describes an authentication bypass and SQL injection vulnerability in PHP Inventory v1.2, including specific payloads for SQLi and reflected XSS. It provides technical details on how to exploit the flaws but does not include functional exploit code.

Classification

Writeup 90%

Attack Type

Sqli | Auth Bypass | Xss

Complexity

Trivial

Reliability

Reliable

Target: PHP Inventory v1.2

No auth needed

Prerequisites: Access to the target web application

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Core References

Exploit exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/10370

Exploit x_refsource_misc

http://packetstormsecurity.org/0912-exploits/phpinventory-sql.txt

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/54667

Scores

EPSS 0.0147

EPSS Percentile 70.4%

Details

CWE

CWE-79

Status published

Products (1)

phpwares/php_inventory 1.2

Published Jan 12, 2010

Tracked Since Feb 18, 2026