CVE-2010-4894: SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbi...

Security readout for executives and security teams

CVE-2010-4894 is a SQL injection issue in chillyCMS 1.1.3. A remote attacker could manipulate the site’s database through the name parameter in core/showsite.php. For leaders, the main concern is exposure of any old public chillyCMS deployment, because database compromise can affect content, credentials, and business records. Exposure is likely limited to organizations still running chillyCMS 1.1.3 or code derived from it, especially internet-facing installations. The provided affected-product metadata is incomplete, so asset validation must rely on application inventory, filesystem review, and route behavior rather than CPE matching alone. Prioritize if any chillyCMS 1.1.3 instance is internet-facing or connected to sensitive data. If no deployment exists, document non-exposure and close. If found, treat as urgent legacy risk because the vulnerability can affect database integrity and confidentiality. Mitigation focus: Identify and remove public exposure for chillyCMS 1.1.3 systems.; Check vendor or maintainer guidance for a fixed release or migration path.; Retire unsupported chillyCMS deployments where no trusted fix is available..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.