CVE-2009-2177: code/display.php in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is disabled, allows remote att...

Security readout for executives and security teams

This old fuzzylime CMS flaw can let a remote attacker manipulate a path parameter and overwrite files when a specific PHP setting is disabled. The business risk is highest for forgotten public legacy sites, because arbitrary file overwrite can lead to website disruption or further compromise. Exposure is likely limited to legacy fuzzylime cms 3.03a or earlier deployments, especially internet-facing PHP sites with magic_quotes_gpc disabled. The provided affected-product metadata is incomplete and lists n/a placeholders. Prioritize if any public legacy fuzzylime CMS remains online. If none exists, document non-exposure and close. Because this is a 2009 issue with incomplete fix data, focus on asset discovery and removal of obsolete software. Mitigation focus: Inventory and retire or replace fuzzylime cms 3.03a or earlier deployments.; Check vendor or archived advisory guidance before applying code-level fixes.; Restrict public access to affected instances during investigation..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.