medium5.0Public exploit code
CVE-2009-0711
filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, i…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHPFootball 1.6 - Remote Hash Disclosure2009-01-01 · webapps · php · Verified
Impact
filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vlad Alexa Mancini | Phpfootball | Versions 1.5, 1.6 |