CVE-2010-5009
UTStats Beta 4 and earlier - SQL Injection via pid Parameter in matchp Action
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-5009. PoCs published by LuM Member.
AI-analyzed exploit summary The code describes multiple vulnerabilities in UTStats, including XSS, SQL Injection, and Full Path Disclosure. It provides specific endpoints and parameters for exploitation but lacks functional exploit code.
Description
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by LuM Member · textwebappsphp
https://www.exploit-db.com/exploits/13854
The code describes multiple vulnerabilities in UTStats, including XSS, SQL Injection, and Full Path Disclosure. It provides specific endpoints and parameters for exploitation but lacks functional exploit code.
Classification
Writeup 80%
Attack Type
Xss | Sqli | Info Leak
Complexity
Trivial
Reliability
Theoretical
Target:
UTStats (All recent versions)
No auth needed
Prerequisites:
Access to the vulnerable web application
devstral-2 · analyzed Feb 18, 2026
Full analysis →
References (6)
Core 6
Core References
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/8506
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/59402
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1465
Exploit exploit
x_refsource_exploit-db
http://www.exploit-db.com/exploits/13854
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/40836
Exploit x_refsource_misc
http://packetstormsecurity.org/1006-exploits/utstats-sqlxss.txt
Scores
EPSS
0.0118
EPSS Percentile
63.8%
Details
CWE
CWE-89
Status
published
Products (2)
ut-files/utstats
ut-files/utstats
< -
Published
Nov 02, 2011
Tracked Since
Feb 18, 2026