CVE-2009-3973: SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitr...

Security readout for executives and security teams

CVE-2009-3973 is a SQL injection issue in Turnkey Arcade Script. A remote attacker could abuse the id parameter in a browse action to run arbitrary database commands. The public record lists exploit references, but it is not in CISA KEV and no active exploitation is cited in the provided sources. Exposure is likely limited to organizations still running Turnkey Arcade Script, especially internet-facing arcade or game portal sites. The source bundle does not identify affected versions or CPEs, so asset discovery must rely on application inventory and web content review. Prioritize review if this application is public-facing or holds user data. The issue is old, has public exploit references, and may indicate unsupported software risk. If present, treat replacement or isolation as a near-term action unless a supported vendor fix is available. Mitigation focus: Identify any Turnkey Arcade Script deployments and determine if they are internet-facing.; Check vendor or maintainer guidance for patched releases or supported migration paths.; If no maintained fix exists, retire, replace, or isolate the application..

Prepared

Jun 28, 2026, 17:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.