CVE-2008-2565 Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) edit.php. NOTE: it wa...
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) edit.php. NOTE: it was later reported that 4.0.x is also affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php-address book | <= 4.0 | No fix listed |
| php-address book | = 1.0 | No fix listed |
| php-address book | = 1.2 | No fix listed |
| php-address book | = 2.0 | No fix listed |
| php-address book | = 2.1 | No fix listed |
| php-address book | = 2.1.1 | No fix listed |
| php-address book | = 2.2 | No fix listed |
| php-address book | = 2.3 | No fix listed |
| php-address book | = 2.4 | No fix listed |
| php-address book | = 2.6 | No fix listed |
| php-address book | = 3.0 | No fix listed |
| php-address book | = 3.1 | No fix listed |
| php-address book | = 3.1.1 | No fix listed |
| php-address book | = 3.1.2 | No fix listed |
| php-address book | = 3.1.3 | No fix listed |
| php-address book | = 3.1.4 | No fix listed |
| php-address book | = 3.1.5 | No fix listed |
| php-address book | = 3.3.16 | No fix listed |
| php-address book | = 3.3.17 | No fix listed |
| php-address book | = 3.3.18 | No fix listed |
| php-address book | = 3.4 | No fix listed |
| php-address book | = 3.4.1 | No fix listed |
| php-address book | = 3.4.2 | No fix listed |
| php-address book | = 3.4.3 | No fix listed |
| php-address book | = 3.4.4 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| php-address book | = 3.4.5 | No fix listed |
| php-address book | = 3.4.6 | No fix listed |
| php-address book | = 3.4.7 | No fix listed |
| php-address book | = 3.4.8 | No fix listed |
References
- packetstormsecurity.com exploit
- 30540 third-party-advisory vendor-advisory
- 35590 third-party-advisory vendor-advisory
- 20090626 MULTIPLE SQL INJECTION VULNERABILITIES --PHP-AddressBook v-4.0.x--> mailing-list
- 35511 vdb-entry
- phpaddressbook-view-edit-sql-injection(42855) vdb-entry
- phpaddressbook-viewphp-sql-injection(99622) vdb-entry
- 5739 exploit
- 9023 exploit