CVE-2009-4887: PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when register_global...

Security readout for executives and security teams

CVE-2009-4887 is a legacy PHP issue in CMS S.Builder 3.7 and earlier. If an old PHP setting, register_globals, is enabled, an attacker may cause the site to include attacker-controlled or local PHP files, potentially leading to server-side code execution. Exposure is likely limited to legacy CMS S.Builder deployments at version 3.7 or earlier, especially internet-facing sites still running PHP with register_globals enabled. Treat as urgent if the organization still hosts CMS S.Builder 3.7 or earlier. The affected software and PHP setting are legacy, but successful exploitation could mean server compromise. If no such deployment exists, priority drops to verification and documentation. Mitigation focus: Identify and retire or upgrade CMS S.Builder 3.7 and earlier deployments.; Disable register_globals wherever this legacy PHP setting remains enabled.; Check vendor guidance for a patch or supported replacement; sources do not name a fix..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.