Unscored severity · published Jul 27, 2009
CVE-2009-2608
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Php Address Book · Chatelao
4.0.1; 4.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2608
Vendor Advisory
http://secunia.com/advisories/35590
www.exploit-db.com
http://www.exploit-db.com/exploits/9023
www.securityfocus.com
http://www.securityfocus.com/archive/1/504595/100/0/threaded
Exploit
http://www.securityfocus.com/bid/35511
More from Php Address Book
8.2
CVE-2020-37083
addressbook 9.0.0.1 - 'id' SQL Injection
–
CVE-2013-1749
Cross-site scripting (XSS) vulnerability in edit.php in PHP Address Book 8.2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via the Address field
–
CVE-2013-1748
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) edit.php or (2)…
–
CVE-2013-2778
Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to hijack the authentication of…
–
CVE-2013-0135
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1)…