CVE-2009-1317: Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic_quotes_gpc is disabled, allow remote att...

Security readout for executives and security teams

CVE-2009-1317 is a legacy SQL injection issue in Aqua CMS 1.1. If the site runs with magic_quotes_gpc disabled, a remote attacker may be able to send crafted input that makes the application run unintended database queries. Business risk depends on whether Aqua CMS 1.1 is still deployed and internet-facing. Exposure is likely limited to legacy Aqua CMS 1.1 installations, especially public sites or admin panels using old PHP configurations where magic_quotes_gpc is disabled. Organizations not running Aqua CMS 1.1 are not indicated as affected by the supplied sources. Prioritize investigation if any Aqua CMS 1.1 site is still live, especially externally reachable systems. This is not broadly relevant unless that legacy product is present, but SQL injection can expose or alter business data when exploitable. Mitigation focus: Identify and isolate any remaining Aqua CMS 1.1 deployments.; Check vendor or archived advisory guidance for fixed versions or supported workarounds.; Restrict public access to admin/index.php and other administrative paths..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.