CVE-2009-4855

CVE-2009-4855 describes a SQL injection vulnerability in TYPO3 4.0, specifically within the index.php file, allowing remote attackers to execute arbitrary SQL commands via the showUid parameter. However, the TYPO3 Security Team disputes this, stating the parameter is typically used by third-party extensions, not the core product. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog and having no Metasploit or Nuclei exploits, an exploit (EDB-9380) is available on ExploitDB, though there is minimal community discussion or media coverage surrounding this CVE.