CVE-2009-4597: Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow (1) remote authenticated use...

Security readout for executives and security teams

PHP Inventory 1.2 has SQL injection flaws that could let attackers manipulate the application database. The login fields are reported as remotely exploitable, while one user details path requires authentication. Public exploit references exist, but the provided sources do not show confirmed active exploitation. Exposure is likely limited to organizations still running PHP Inventory 1.2, especially if the application is internet-facing or reachable by untrusted users. The supplied structured affected-product fields are incomplete and list n/a. Treat as high priority only if PHP Inventory 1.2 is present. Public exploit references and possible unauthenticated database manipulation create meaningful business risk, but the record is old and lacks active exploitation evidence. Mitigation focus: Identify whether PHP Inventory 1.2 is deployed anywhere.; Restrict public access until vendor guidance is confirmed.; Check vendor or maintainer sources for fixed versions or replacement guidance..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.