CVE-2009-2608 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 0.9% (pctl 59)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php. NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 0.91% — more likely to be exploited than 59% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-07-27 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| chatelao | php address book |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | PHP-Address Book 4.0.x - Multiple SQL Injections | 2009-06-26 |
References
- http://secunia.com/advisories/35590
- http://www.exploit-db.com/exploits/9023
- http://www.securityfocus.com/archive/1/504595/100/0/threaded
- http://www.securityfocus.com/bid/35511
- http://secunia.com/advisories/35590
- http://www.exploit-db.com/exploits/9023
- http://www.securityfocus.com/archive/1/504595/100/0/threaded
- http://www.securityfocus.com/bid/35511
→ the Explorer · watch your stack · NVD