CVE-2009-1741

CVE-2009-1741 describes multiple SQL injection vulnerabilities in DM FileManager 3.9.2, specifically within the login.php script, when the magic_quotes_gpc setting is disabled. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the Username and Password fields. The vulnerability has a CVSS score of 6.8, indicating a medium severity, as it can be exploited over the network with medium complexity to achieve partial confidentiality, integrity, and availability impacts. While not listed on the KEV catalog, an exploit for authentication bypass is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.