CVE-2009-2608

EUVD-2009-2603
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php.  NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
chatelaophp_address_book
4.0.1
chatelaophp_address_book
4.0.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/35590
http://www.exploit-db.com/exploits/9023
http://www.securityfocus.com/archive/1/504595/100/0/threaded
http://www.securityfocus.com/bid/35511
http://secunia.com/advisories/35590
http://www.exploit-db.com/exploits/9023
http://www.securityfocus.com/archive/1/504595/100/0/threaded
http://www.securityfocus.com/bid/35511