CVEvulnerability
CVE-2009-2608
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-07-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.
Affected configurations
• chatelao php address book 4.0.1
• chatelao php address book 4.0.2
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://secunia.com/advisories/35590 Vendor Advisory
- http://www.exploit-db.com/exploits/9023 www.exploit-db.com
- http://www.securityfocus.com/archive/1/504595/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/35511 Exploit
- http://secunia.com/advisories/35590 Vendor Advisory
- http://www.exploit-db.com/exploits/9023 www.exploit-db.com
- http://www.securityfocus.com/archive/1/504595/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/35511 Exploit