CVE-2013-0135
CVE-2013-0135
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
Affected products
n/a · n/apublic PoCs found — 12
cve_referencepacketstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.htmlunverifiedexploitdbwww.exploit-db.com/exploits/38435unverifiedexploitdbwww.exploit-db.com/exploits/38434unverifiedexploitdbwww.exploit-db.com/exploits/38425unverifiedexploitdbwww.exploit-db.com/exploits/38426unverifiedexploitdbwww.exploit-db.com/exploits/38427unverifiedexploitdbwww.exploit-db.com/exploits/38428unverifiedexploitdbwww.exploit-db.com/exploits/38429unverifiedexploitdbwww.exploit-db.com/exploits/38430unverifiedexploitdbwww.exploit-db.com/exploits/38431unverifiedexploitdbwww.exploit-db.com/exploits/38432unverifiedexploitdbwww.exploit-db.com/exploits/38433unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →