Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 7.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to group.php, or the (2) target_language or (3) target_flag parameter to translate.php.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| chatelao | php_address_book | 3.3.18 |
| chatelao | php_address_book | 5.4.6 |
| chatelao | php_address_book | 4.1.4 |
| chatelao | php_address_book | 3.3 |
| chatelao | php_address_book | 2.2 |
| chatelao | php_address_book | 3.3.9 |
| chatelao | php_address_book | 5.6 |
| chatelao | php_address_book | 3.3.3 |
| chatelao | php_address_book | 3.3.17 |
| chatelao | php_address_book | 3.2 |
| chatelao | php_address_book | 5.2 |
| chatelao | php_address_book | 3.4.6 |
| chatelao | php_address_book | 3.4 |
| chatelao | php_address_book | 5.1 |
| chatelao | php_address_book | 3.1.1 |
| chatelao | php_address_book | 3.2.13 |
| chatelao | php_address_book | 5.4 |
| chatelao | php_address_book | 5.4.4 |
| chatelao | php_address_book | 4.0.2 |
| chatelao | php_address_book | 5.4.2 |
| chatelao | php_address_book | 5.7.2 |
| chatelao | php_address_book | 5.7.5 |
| chatelao | php_address_book | 3.2.6 |
| chatelao | php_address_book | 3.1.2 |
| chatelao | php_address_book | 3.1 |
| chatelao | php_address_book | 1.0 |
| chatelao | php_address_book | 3.1.5 |
| chatelao | php_address_book | 3.2.3 |
| chatelao | php_address_book | 3.3.1 |
| chatelao | php_address_book | * |
| chatelao | php_address_book | 5.4.7 |
| chatelao | php_address_book | 3.3.6 |
| chatelao | php_address_book | 2.0 |
| chatelao | php_address_book | 3.2.14 |
| chatelao | php_address_book | 3.2.8 |
| chatelao | php_address_book | 5.4.1 |
| chatelao | php_address_book | 3.3.15 |
| chatelao | php_address_book | 3.4.8 |
| chatelao | php_address_book | 5.7 |
| chatelao | php_address_book | 2.6 |
| chatelao | php_address_book | 3.3.7 |
| chatelao | php_address_book | 3.3.16 |
| chatelao | php_address_book | 5.7.4 |
| chatelao | php_address_book | 4.1.1 |
| chatelao | php_address_book | 3.2.2 |
| chatelao | php_address_book | 3.2.12 |
| chatelao | php_address_book | 5.8.1 |
| chatelao | php_address_book | 3.4.2 |
| chatelao | php_address_book | 6.1 |
| chatelao | php_address_book | 3.0 |
| chatelao | php_address_book | 3.1.6 |
| chatelao | php_address_book | 3.3.2 |
| chatelao | php_address_book | 5.7.3 |
| chatelao | php_address_book | 3.3.12 |
| chatelao | php_address_book | 3.4.3 |
| chatelao | php_address_book | 5.4.3 |
| chatelao | php_address_book | 3.2.7 |
| chatelao | php_address_book | 2.1.1 |
| chatelao | php_address_book | 2.1 |
| chatelao | php_address_book | 3.1.4 |
| chatelao | php_address_book | 3.3.13 |
| chatelao | php_address_book | 3.3.8 |
| chatelao | php_address_book | 2.4 |
| chatelao | php_address_book | 3.3.5 |
| chatelao | php_address_book | 3.2.11 |
| chatelao | php_address_book | 4.1.3 |
| chatelao | php_address_book | 3.2.4 |
| chatelao | php_address_book | 3.1.3 |
| chatelao | php_address_book | 5.3 |
| chatelao | php_address_book | 5.5 |
| chatelao | php_address_book | 6.0 |
| chatelao | php_address_book | 3.2.1 |
| chatelao | php_address_book | 5.7.1 |
| chatelao | php_address_book | 2.3 |
| chatelao | php_address_book | 3.2.10 |
| chatelao | php_address_book | 3.4.1 |
| chatelao | php_address_book | 3.4.7 |
| chatelao | php_address_book | 3.3.4 |
| chatelao | php_address_book | 5.4.5 |
| chatelao | php_address_book | 3.2.9 |
| chatelao | php_address_book | 3.3.10 |
| chatelao | php_address_book | 3.3.14 |
| chatelao | php_address_book | 3.4.4 |
| chatelao | php_address_book | 1.2 |
| chatelao | php_address_book | 5.0 |
| chatelao | php_address_book | 3.2.5 |
| chatelao | php_address_book | 4.0 |
| chatelao | php_address_book | 5.4.9 |
| chatelao | php_address_book | 3.4.5 |
| chatelao | php_address_book | 3.4.9 |
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-89,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| chatelao | php_address_book | 8.2.5 |
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) edit.php or (2) import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector is already covered by CVE-2008-2565.2.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-89,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| chatelao | php_address_book | 8.2.5 |
Cross-site scripting (XSS) vulnerability in edit.php in PHP Address Book 8.2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via the Address field.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| chatelao | php_address_book | 8.2.5 |
Cross-site request forgery (CSRF) vulnerability in addressbook/register/delete_user.php in PHP Address Book 8.2.5 allows remote attackers to hijack the authentication of administrators for requests that delete accounts, a different vulnerability than CVE-2013-0135.1.
CVSS 2.0
Severity: HIGH
Problem Type: CWE-352,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| chatelao | php_address_book | 8.2.5 |