CVE-2009-1587: index.php in PHP Site Lock 2.0 allows remote attackers to bypass authentication and obtain administrative a...

Security readout for executives and security teams

PHP Site Lock 2.0 could let an unauthenticated remote user gain administrative access by manipulating authentication cookies. For any organization still running this legacy PHP component, the business risk is direct compromise of protected site administration. The source bundle does not identify a vendor patch or current exploitation. Exposure is likely limited to legacy websites that still deploy PHP Site Lock 2.0, especially public internet-facing installations. The bundle lists affected metadata as n/a, so asset discovery must confirm the product and version locally. Treat confirmed exposure as urgent legacy-risk remediation. The issue can grant administrative access remotely, but urgency depends on whether PHP Site Lock 2.0 is actually deployed and reachable. Mitigation focus: Inventory and remove any remaining PHP Site Lock 2.0 deployments.; Replace the component with supported server-side access control.; Restrict administrative paths behind VPN, SSO, or edge access controls..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.