CVE-2008-4557: CuteNews Strawberry html.php code injection via text parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with complete impact and a public exploit, though the product is old and no KEV listing exists.

What it is

The html.php file in the wacko/highlight plugin of CuteNews.ru 1.1.1 (Strawberry) inserts the user-supplied text parameter into an executable regular expression. Because the input is not neutralized before being evaluated, an attacker can inject PHP code that the application then executes. This is a remote, unauthenticated code execution flaw in a web-facing component.

Impact

An attacker can run arbitrary PHP code with the privileges of the web server, leading to full compromise of the application and potentially the host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

The flaw is reached over the network through the text parameter handled by plugins/wacko/highlight/html.php. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

No CISA KEV listing and no ransomware association are recorded, but EPSS is 0.45338 (98.7th percentile) and a public Exploit-DB entry (4851) exists, so exploitation is feasible and likely observed in the wild.

What to do

• Apply the vendor fix or upgrade CuteNews to a version where the text parameter is not evaluated as a regular expression; if no patch is available, remove or disable the wacko/highlight plugin.
• If the plugin cannot be removed, block or strictly validate the text parameter at the web server or WAF before it reaches html.php.
• Run the PHP application under a low-privilege account and restrict filesystem and outbound network access to limit post-exploitation impact.
• Isolate or retire the CuteNews 1.1.1 instance if it cannot be patched, since the product is long end-of-life.

Detection

• Search web and PHP logs for requests to plugins/wacko/highlight/html.php with unusual or PHP-code-like text parameter values.
• Monitor for unexpected PHP process execution, file writes, or outbound connections originating from the web server user.
• Alert on repeated or anomalous access to the wacko/highlight plugin path from single source IPs.
• Review file integrity on the web root for newly created or modified PHP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.