CVE-2009-3970: Phpdirsubmit PHP Dir Submit

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

SQL injection vulnerability in index.php in PHP Dir Submit (aka WebsiteSubmitter or Submitter Script) allows remote authenticated users to execute arbitrary SQL commands via the aid parameter in a showarticle action.

Affected products

• Phpdirsubmit PHP Dir Submit: any version

Published 2009-11-18. Last modified 2026-06-16.