CVE-2003-1240

CVE-2003-1240 describes a remote file inclusion vulnerability in CuteNews version 0.88, allowing attackers to execute arbitrary PHP code. This critical flaw stems from insufficient validation of the 'cutepath' parameter in shownews.php, search.php, and comments.php. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low complexity, potentially leading to full compromise of confidentiality, integrity, and availability. While not currently on CISA's KEV catalog or showing active exploitation, public exploit code is available on ExploitDB, indicating a clear path for adversaries. Despite its age, the high FAUCET Risk Score of 89/100 suggests significant potential impact if exploited.