Test ID:	1.3.6.1.4.1.25623.1.0.900698
Category:	Web application abuses
Title:	PHP Address Book Multiple SQL Injection Vulnerabilities
Summary:	PHP Address Book is prone to an SQL injection (SQLi) vulnerability.
Description:	Summary: PHP Address Book is prone to an SQL injection (SQLi) vulnerability. Vulnerability Insight: The flaw is due to improper sanitization of user supplied input passed to the 'id' parameter in view.php, edit.php, and delete.php, and to the 'alphabet' parameter in index.php before being used in SQL queries. Vulnerability Impact: Successful exploitation will let the attacker cause SQL Injection attack, gain sensitive information about the database used by the web application. Affected Software/OS: PHP Address Book version 4.0.x Solution: Upgrade to PHP Address Book version 5.7.2 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-2608 BugTraq ID: 35511 http://www.securityfocus.com/bid/35511 Bugtraq: 20090626 MULTIPLE SQL INJECTION VULNERABILITIES --PHP-AddressBook v-4.0.x--> (Google Search) http://www.securityfocus.com/archive/1/504595/100/0/threaded http://www.exploit-db.com/exploits/9023 http://secunia.com/advisories/35590
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.