CVE-2009-0517

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 2.010.0Critical EPSS percentile99th49% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2009-02-11Updated 2026-04-23Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether any website runs phpSlash and confirm its installed version.
Treat phpSlash 0.8.1.1 and earlier as affected; no exact vendor fixed version is documented in the available findings.
Ask your hosting provider or developer to apply the vendor remediation or replace the software if a supported update is unavailable.
Review the website for unfamiliar administrator accounts, changed files, or unexpected outbound activity after remediation.

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Eval injection vulnerability in index.php in phpSlash 0.8.1.1 and earlier allows remote attackers to execute arbitrary PHP code via the fields parameter, which is supplied to an eval function call within the generic function in include/class/tz_env.class. NOTE: some of these details are obtained from third party information.

In plain language

Written by AI from the record

phpSlash 0.8.1.1 and earlier can let an internet attacker take over the website, so affected small businesses should act soon.

Unauthenticated remote PHP code execution in phpSlash 0.8.1.1 and earlier occurs when the fields parameter reaches an eval call in index.php.

If you're affected

Complete website takeover
Customer data exposure
Malicious website changes
Service disruption
Ransomware risk

What is it

This is a flaw in phpSlash that can allow someone to send a specially crafted request and make the website run their instructions. It is like a visitor being able to slip their own master key into your office’s lock system, giving them control over the premises.

Who is affected

This matters to you if you run phpSlash for a website, especially version 0.8.1.1 or earlier. It is only a risk if the phpSlash site is reachable from the internet.

How urgent is it

Public exploit code is available, meaning attackers have a ready-made starting point. This is an amber issue: address it promptly, particularly for an internet-facing site, but the available findings do not confirm active exploitation.

What to do — in detail

Confirm exposure by locating phpSlash installations, checking their version, and identifying whether index.php is publicly reachable. phpSlash 0.8.1.1 and earlier are affected; the available patch finding provides vendor remediation information but does not document a specific fixed release, so obtain the supported remediation from the vendor or maintainer before upgrading.

If a supported update is not available, plan to replace or retire the phpSlash deployment. Until then, restrict public access to the affected site where business operations allow, and have the hosting provider inspect web-server and application logs for suspicious requests to the fields parameter, unexpected PHP files, changed application files, and unfamiliar administrator activity. This CVE is not listed in CISA KEV, so there is no CISA remediation due date.

Technical context

CVE-2009-0517 has CVSS 10.0 (Critical) and is CWE-94 code injection. A remote attacker can supply the fields parameter to reach an eval call in index.php, enabling arbitrary PHP code execution without authentication. Two public exploits are known. EPSS predicts a 48.9% likelihood (99th percentile) and the trend is falling; this is predictive data, not confirmation of in-the-wild exploitation. The CVE is not in CISA KEV.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.