{"api_version":"1","generated_at":"2026-07-23T08:57:41+00:00","cve":"CVE-2009-1787","urls":{"html":"https://cve.report/CVE-2009-1787","api":"https://cve.report/api/cve/CVE-2009-1787.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-1787","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-1787"},"summary":{"title":"CVE-2009-1787","description":"Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authentication and gain administrative access via the (1) username and (2) password parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-05-26 16:30:02","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2009/1365","name":"http://www.vupen.com/english/advisories/2009/1365","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/35003","name":"http://www.securityfocus.com/bid/35003","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"RETIRED: PHP Dir Submit Admin Login SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/35125","name":"http://secunia.com/advisories/35125","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"PHP Dir Submit Login SQL Injection Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/8710","name":"https://www.exploit-db.com/exploits/8710","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"PHP Dir Submit (Auth Bypass) SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1787","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1787","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"1787","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"phpdirsubmit","cpe5":"php_dir_submit","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:27:54.460Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"35003","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/35003"},{"name":"ADV-2009-1365","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/1365"},{"name":"35125","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/35125"},{"name":"8710","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/8710"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-05-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authentication and gain administrative access via the (1) username and (2) password parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"35003","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/35003"},{"name":"ADV-2009-1365","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/1365"},{"name":"35125","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/35125"},{"name":"8710","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/8710"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-1787","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authentication and gain administrative access via the (1) username and (2) password parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"35003","refsource":"BID","url":"http://www.securityfocus.com/bid/35003"},{"name":"ADV-2009-1365","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/1365"},{"name":"35125","refsource":"SECUNIA","url":"http://secunia.com/advisories/35125"},{"name":"8710","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/8710"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-1787","datePublished":"2009-05-26T16:00:00.000Z","dateReserved":"2009-05-26T00:00:00.000Z","dateUpdated":"2024-08-07T05:27:54.460Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-05-26 16:30:02","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:phpdirsubmit:php_dir_submit:*:*:*:*:*:*:*:*","matchCriteriaId":"F4D4E8BA-785F-4B02-AA66-8010C002EFC1"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"1787","Ordinal":"1","Title":"CVE-2009-1787","CVE":"CVE-2009-1787","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"1787","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in PHP Dir Submit (aka WebsiteSubmitter and Submitter Script) allow remote attackers to bypass authentication and gain administrative access via the (1) username and (2) password parameters.","Type":"Description","Title":"CVE-2009-1787"},{"CveYear":"2009","CveId":"1787","Ordinal":"2","NoteData":"2009-05-26","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"1787","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}