CVE-2009-4566

CVE-2009-4566 describes a SQL injection vulnerability in Zenphoto version 1.2.5, specifically within the index.php file. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands by manipulating the 'title' parameter during a 'news' action. With a CVSS score of 7.5, it is considered highly severe due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed on the CISA KEV catalog, an exploit (EDB-9154) is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, Nuclei templates, or significant community discussion or media coverage.