« Volver al listado

CVE-2009-0711

Estado: ModificadaMedia (5)—💥 Exploit

filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Vlad Alexa Mancini — Phpfootball

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-0711",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-02-23T15:30:04.360",
  "references": [
    {
      "url": "http://secunia.com/advisories/33367",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/51102",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/7636",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/33367",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/51102",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/7636",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter.  NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown."
    },
    {
      "lang": "es",
      "value": "filter.php en PHPFootball v1.6 y anteriores permite a atacantes remotos obtener hashes de contraseñas a través de una petición con un valor Accounts en el parámetro \"dbtable\", en conjunción con el valor Password en el parámetro \"dbfield\": NOTA: Esto ha sido reportado como una inyección SQL por algunas fuentes, pero el origen de esta información es desconocido.\r\n"
    }
  ],
  "lastModified": "2026-06-16T23:05:37.100",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vlad_alexa_mancini:phpfootball:1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1E33B72-3F09-4468-A8E2-6F06D884A167"
            },
            {
              "criteria": "cpe:2.3:a:vlad_alexa_mancini:phpfootball:1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C06D627A-00E6-44B1-B0D2-46DFF5C1A551"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}