CVE-2013-0135
PHP Address Book 8.2.5 - SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 11 public exploits for CVE-2013-0135. PoCs published by Jurgen Voorneveld.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, specifically in the POST parameter 'email' of the user registration endpoint. It lacks actual exploit code but references the vulnerability details and affected version.
Description
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
Exploits (11)
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, specifically in the POST parameter 'email' of the user registration endpoint. It lacks actual exploit code but references the vulnerability details and affected version.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where unsanitized user input in the 'var' parameter of traffic.php can be exploited. However, no actual exploit code is included, only a description and a sample URL.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where insufficient input sanitization in the 'BasicLogin' cookie variable allows attackers to manipulate SQL queries. No actual exploit code is included, only a description and reference link.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where unsanitized user input in the reset_password_save.php script can be exploited. The writeup includes a sample URL demonstrating the vulnerable parameters but lacks actual exploit code.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where unsanitized user input in the 'email' and 'password' parameters of the reset_password.php script can be exploited. No actual exploit code is included, only a description and a URL template for exploitation.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where the 'site' parameter in 'linktick.php' is not properly sanitized. It lacks actual exploit code but references the vulnerability and its potential impact.
This is a vulnerability writeup describing SQL injection vulnerabilities in PHP Address Book 8.2.5. It provides a URL template demonstrating how unsanitized input parameters can be exploited but does not include functional exploit code.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where the 'id' parameter in 'edit_user.php' is not properly sanitized. It lacks actual exploit code, serving only as a vulnerability description.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where the 'id' parameter in 'delete_user.php' is not properly sanitized. No actual exploit code is included, only a description and a sample URL.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where unsanitized user input in the 'username' parameter of 'checklogin.php' can be exploited. No actual exploit code is included, only a description and a sample URL.
The provided text describes a SQL injection vulnerability in PHP Address Book 8.2.5, where unsanitized user input in the 'q' parameter of 'admin_index.php' can be exploited. However, no actual exploit code is included, only a description and a sample URL.