CVE-2012-2306

The CVE-2012-2306 entry concerns the Drupal Addressbook contributed module, affected in 6.x-4.2 and earlier. The root cause is a SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact is described as potential partial confidentia...

CVE-2012-2307

Cross-site request forgery CSRF vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-2306: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...