Lucene search

[email protected]CVE-2009-2608

HistoryJul 27, 2009 - 6:30 p.m.

CVE-2009-2608

2009-07-2718:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2009-2608

php

address book

sql injection

remote execution

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.4 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.5%

JSON

Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.

Affected configurations

NVD

Node

chatelaophp_address_bookMatch4.0.1

chatelaophp_address_bookMatch4.0.2

CPENameOperatorVersion
chatelao:php_address_bookchatelao php address bookeq4.0.1
chatelao:php_address_bookchatelao php address bookeq4.0.2

CPE	Name	Operator	Version
chatelao:php_address_book	chatelao php address book	eq	4.0.1
chatelao:php_address_book	chatelao php address book	eq	4.0.2

References

secunia.com/advisories/35590

www.exploit-db.com/exploits/9023

www.securityfocus.com/archive/1/504595/100/0/threaded

www.securityfocus.com/bid/35511

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.4 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.5%

JSON

Related for CVE-2009-2608

prion4 nvd5 cvelist4 openvas2 cve4