Lucene search

[email protected]CVE-2009-0711

HistoryFeb 23, 2009 - 3:30 p.m.

CVE-2009-0711

2009-02-2315:30:04

CWE-200

[email protected]

web.nvd.nist.gov

phpfootball

filter.php

remote attackers

retrieve password hashes

sql injection vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.6 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

53.6%

JSON

filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.

Affected configurations

NVD

Node

vlad_alexa_manciniphpfootballMatch1.5

vlad_alexa_manciniphpfootballMatch1.6

CPENameOperatorVersion
vlad_alexa_mancini:phpfootballvlad alexa mancini phpfootballeq1.5
vlad_alexa_mancini:phpfootballvlad alexa mancini phpfootballeq1.6

CPE	Name	Operator	Version
vlad_alexa_mancini:phpfootball	vlad alexa mancini phpfootball	eq	1.5
vlad_alexa_mancini:phpfootball	vlad alexa mancini phpfootball	eq	1.6

References

secunia.com/advisories/33367

www.osvdb.org/51102

www.exploit-db.com/exploits/7636

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.6 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

53.6%

JSON

Related for CVE-2009-0711

prion1 nvd1 openvas4 cvelist1