Exploitation Summary
EIP tracks 1 public exploit for CVE-2009-4791. PoCs published by Salvatore Fresta.
AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in Family Connection CMS <= 1.8.2, allowing remote command execution by writing a malicious PHP file to the server via SQL injection in the authentication cookie.
Description
Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to addressbook.php, (2) id parameter to recipes.php, (3) year parameter to register.php, (4) poll_id parameter to home.php, and (5) email parameter to lostpw.php.
Exploits (1)
This exploit demonstrates a blind SQL injection vulnerability in Family Connection CMS <= 1.8.2, allowing remote command execution by writing a malicious PHP file to the server via SQL injection in the authentication cookie.