CVE-2009-3970: SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allow...

Security readout for executives and security teams

CVE-2009-3970 is an SQL injection issue in PHP Dir Submit, also known as WebsiteSubmitter or Submitter Script. A logged-in remote user could manipulate the article display parameter to run database commands. This is an old, niche application issue, but database compromise risk is meaningful where the product remains deployed. Exposure is likely limited to organizations still running PHP Dir Submit, WebsiteSubmitter, or Submitter Script. Risk is highest for internet-facing installations where untrusted or weakly controlled authenticated accounts exist. The source data does not identify affected versions or package fingerprints. Prioritize if this software is internet-facing or accepts external user accounts. The business risk is potential database access or alteration by authenticated users. If the product is absent, no action is needed beyond confirming inventory. Mitigation focus: Check vendor or maintainer guidance for patches or supported upgrade paths.; Remove or replace unsupported PHP Dir Submit installations where feasible.; Restrict access to authenticated users with a business need..

Prepared

Jun 28, 2026, 17:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.