CVE-2009-4884: Multiple SQL injection vulnerabilities in phpCommunity 2 2.1.8, when magic_quotes_gpc is disabled, allow re...

Security readout for executives and security teams

CVE-2009-4884 affects phpCommunity 2 version 2.1.8 when PHP magic_quotes_gpc is disabled. Attackers could manipulate forum or search inputs so the application sends unintended SQL to its database. Business impact depends on whether this old application is still internet-facing and connected to sensitive data. Exposure is most likely in legacy phpCommunity 2 2.1.8 deployments with public forum or search functionality and magic_quotes_gpc disabled. The bundle lists affected vendor/product as n/a, so asset matching may require code, title, and file-path evidence rather than CPE matching. Treat this as a high-priority legacy exposure check, not an emergency unless phpCommunity 2.1.8 is still reachable. Public exploit references raise risk, but the provided sources do not show current active exploitation or a named patch. Mitigation focus: Identify any phpCommunity 2 2.1.8 deployments, especially public forums or search pages.; Check vendor or project guidance for a fixed release or supported migration path.; If no supported fix exists, restrict access or retire the application..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.