Exploitation Summary
EIP tracks 1 public exploit for CVE-2010-1109. PoCs published by XaDoS.
AI-analyzed exploit summary This exploit demonstrates SQL injection and XSS vulnerabilities in PhpMySport v1.4. The SQLi allows attackers to extract user credentials via a crafted UNION-based query, while the XSS can be triggered via URL parameters.
Description
Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an information action, (4) v2 parameter in a team view action, (5) v2 parameter in a club view action, or (6) v2 parameter in a matches view action.
Exploits (1)
This exploit demonstrates SQL injection and XSS vulnerabilities in PhpMySport v1.4. The SQLi allows attackers to extract user credentials via a crafted UNION-based query, while the XSS can be triggered via URL parameters.