CVE-2009-4471

CVE-2009-4471 describes multiple remote file inclusion vulnerabilities in FreeSchool 1.1.0 and earlier versions. Attackers can exploit this by injecting a malicious URL into the CLASSPATH parameter of various PHP scripts, leading to arbitrary PHP code execution. This vulnerability carries a CVSS score of 7.5, indicating high severity. It is easily exploitable over the network without authentication (AV:N/AC:L/Au:N), and successful exploitation can result in partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). While not listed in CISA's KEV catalog, public exploit code (EDB-9582) exists, suggesting potential for exploitation. Despite this, there is minimal community discussion or media coverage surrounding this decade-old vulnerability.