Information disclosure in Vlad Alexa Mancini Phpfootball
CVE-2009-0711
filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.
Vulnerability class: Information Disclosure
EPSS: 0.012 (65.2th percentile) — read the EPSS interpretation.
Affected products
- Vlad_alexa_mancini Phpfootball — versions 1.5, 1.6
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)