CVE-2009-0517: phpSlash index.php eval injection allows remote PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote code execution with complete impact and public exploit code, though no KEV listing.

What it is

phpSlash 0.8.1.1 and earlier passes the fields parameter from index.php into an eval function call inside the generic function in include/class/tz_env.class, allowing code injection. Because the injected value is evaluated as PHP, a remote attacker can run arbitrary code in the context of the web server. The record notes some details come from third-party information, so the exact code path is not fully documented here.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the server, leading to full compromise of the application and potentially the host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as complete.

Attack surface

Reached over the network through index.php by supplying a crafted fields parameter; the CVSS 2.0 vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. No affected version range beyond 0.8.1.1 and earlier is stated in the record.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.55019 (98.98th percentile) and references include an Exploit tag and an Exploit-DB entry, indicating public exploit code exists.

What to do

• Upgrade phpSlash beyond 0.8.1.1, or remove the product if no fixed release is available, since the record does not name a patched version.
• Eliminate the eval call in include/class/tz_env.class and replace it with strict input validation or a safe dispatch mechanism.
• Restrict or block access to index.php fields parameter values containing PHP code constructs at the web application firewall or reverse proxy.
• Run the PHP application with least privilege and disable dangerous functions such as eval where feasible via php.ini.
• Monitor vendor and OSVDB/Secunia advisories for an official fix, as the record only cites third-party information.

Detection

• Search web server and PHP logs for requests to index.php with unusual or PHP-code-like fields parameter values.
• Alert on eval-related errors or unexpected PHP execution traces in application logs.
• Hunt for outbound connections or spawned processes from the web server user that are inconsistent with normal phpSlash behavior.
• Use file integrity monitoring on include/class/tz_env.class and other phpSlash files to catch tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.