CVE-2009-1452: Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attack...

Security readout for executives and security teams

CVE-2009-1452 is a remote file inclusion issue in SMA-DB 0.3.13. If an affected legacy installation is exposed, an attacker could cause the application to load remote PHP through specific page-formatting parameters, leading to arbitrary PHP execution. The public record does not provide CVSS, confirmed patch details, or evidence of active exploitation. Exposure is likely limited to organizations still running SMA-DB 0.3.13, especially internet-facing deployments where theme/format.php is reachable. Because the affected product is old and niche, the main risk is forgotten legacy software, archived applications, or unmanaged hosting environments. Prioritize this if SMA-DB is present or internet-facing. The product is old, but the impact is severe: arbitrary PHP execution can become full application compromise. If no instance exists, record the finding as not applicable and monitor legacy inventory controls. Mitigation focus: Identify any SMA-DB 0.3.13 deployments, including archived or unmanaged web roots.; Check vendor or archived project guidance for a patched release or supported replacement.; Remove or disable SMA-DB 0.3.13 if no supported fix is available..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.