CVE-2009-4597
PHP Inventory 1.2 - SQL Injection via User ID, Username, or Password Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-4597. PoCs published by mr_me.
AI-analyzed exploit summary The document describes an authentication bypass and SQL injection vulnerability in PHP Inventory v1.2, including specific payloads for SQLi and reflected XSS. It provides technical details on how to exploit the flaws but does not include functional exploit code.
Description
Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a users details action, and allow remote attackers to execute arbitrary SQL commands via the (2) user (username) and (3) pass (password) parameters. NOTE: some of these details are obtained from third party information.
Exploits (1)
The document describes an authentication bypass and SQL injection vulnerability in PHP Inventory v1.2, including specific payloads for SQLi and reflected XSS. It provides technical details on how to exploit the flaws but does not include functional exploit code.