CVE-2009-2608

Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php.  NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
chatelaophp_address_book
4.0.1
chatelaophp_address_book
4.0.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/35590
http://www.exploit-db.com/exploits/9023
http://www.securityfocus.com/archive/1/504595/100/0/threaded
http://www.securityfocus.com/bid/35511
http://secunia.com/advisories/35590
http://www.exploit-db.com/exploits/9023
http://www.securityfocus.com/archive/1/504595/100/0/threaded
http://www.securityfocus.com/bid/35511