Analyst readout for executives and security teams
Plain-English summary
CVE-2009-0493 is a SQL injection in IT!CMS login.php in version 2.1a and earlier. A remote user could manipulate the Username field to run database commands. The business risk is compromise of a legacy CMS database, including possible exposure of credentials or site content if any instance remains online.
Executive priority
Treat this as a targeted legacy cleanup issue. It is not KEV-listed in the bundle, but remote SQL injection on a login page with public exploit references justifies prompt inventory and removal or isolation.
Technical view
The CVE describes unsanitized Username input to login.php allowing arbitrary SQL command execution against IT!CMS 2.1a and earlier. The bundle lists Exploit-DB, IBM X-Force, and SecurityFocus references, but provides no CVSS vector, CWE, vendor advisory, patch version, or precise CPE data.
Likely exposure
Likely exposure is narrow but serious: internet-facing IT!CMS 2.1a or earlier deployments, especially abandoned legacy sites. The source bundle does not identify a vendor CPE or broader product family.
Exploitation context
A public Exploit-DB reference exists, so proof-of-concept information was publicly available. The bundle does not show CISA KEV listing or any cited evidence of active exploitation in the wild.
Researcher notes
Evidence is sparse and old. The key confirmed facts are product and version scope, login.php Username injection, arbitrary SQL impact, and public vulnerability references. Avoid assuming modern exploit activity, affected forks, or a specific patch without vendor evidence.
Mitigation direction
- Inventory public web assets for IT!CMS 2.1a or earlier.
- Check vendor or maintainer guidance for any fixed release or migration path.
- Retire or isolate unsupported IT!CMS installations where no fix is available.
- Restrict access to login.php with network controls if immediate removal is not possible.
- Add monitored web application filtering as a compensating control.
Validation and detection
- Confirm whether login.php belongs to IT!CMS and identify the application version.
- Review web logs for unusual Username input patterns and database error responses.
- Check database accounts used by the CMS for excessive privileges.
- Verify that internet-facing scanners include this legacy CMS exposure.
- Document any compensating controls and remaining unsupported software risk.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2009-0493 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- itcms-login-sql-injection(47791)CVE reference · vdb-entry, x_refsource_XF
- 7686CVE reference · exploit, x_refsource_EXPLOIT-DB
- 33139CVE reference · vdb-entry, x_refsource_BID
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.