CVE-2008-2566
php-address_book < 3.1.5 - Cross-Site Scripting via Group Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2008-2566. PoCs published by CWH Underground.
AI-analyzed exploit summary The exploit demonstrates SQL injection and XSS vulnerabilities in PHP-Address Book <= 3.1.5. It provides functional exploit URLs for SQLi via union-based injection in view.php and edit.php, and XSS via the 'group' parameter in index.php.
Description
Multiple cross-site scripting (XSS) vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the group parameter to (1) index.php or (2) the default URI.
Exploits (2)
The exploit demonstrates SQL injection and XSS vulnerabilities in PHP-Address Book <= 3.1.5. It provides functional exploit URLs for SQLi via union-based injection in view.php and edit.php, and XSS via the 'group' parameter in index.php.
The exploit demonstrates multiple SQL injection and XSS vulnerabilities in PHP Address Book 6.2.12. It provides direct URLs with payloads for blind SQL injection and XSS attacks, confirming the vulnerabilities are exploitable.