CVE-2009-0610

CVE-2009-0610 describes multiple static code injection vulnerabilities in Simple PHP News 1.0 final, specifically within the post.php component. Attackers can inject arbitrary PHP code into the news.txt file by manipulating the title or date parameters, which is then executed via a direct request to display.php. This vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, suggesting a known method for exploitation, though there is minimal community discussion or media coverage surrounding this decade-old flaw.