Description

Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.

Remediation

References

CVE-2009-2608

Related Vulnerabilities

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7986)

WordPress Plugin To Top Security Bypass (2.2.2)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Unspecified Vulnerability (4.3.4)

WordPress Plugin rtMedia for WordPress, BuddyPress and bbPress Cross-Site Scripting (3.10.1)

WordPress Plugin Bold Page Builder PHP Object Injection (3.1.5)

Severity

Medium

Classification

CVE-2009-2608 CWE-138

Tags

Missing Update Known Vulnerabilities