Description

Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.

Remediation

References

CVE-2009-2608

Related Vulnerabilities

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-0126)

Oracle Database Server CVE-2006-0266 Vulnerability (CVE-2006-0266)

WordPress Plugin Live Scores for SportsPress Multiple Vulnerabilities (1.9.0)

Internet Information Services Other Vulnerability (CVE-2003-0223)

WordPress Plugin SI CAPTCHA Anti-Spam Serving Spam (3.0.2)

Severity

Medium

Classification

CVE-2009-2608 CWE-138

Tags

Missing Update Known Vulnerabilities