CVE-2013-1748
PHP Address Book 8.2.5 - SQL Injection via edit.php or import.php Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-1748. PoCs published by CWH Underground.
AI-analyzed exploit summary The exploit demonstrates SQL injection and XSS vulnerabilities in PHP-Address Book <= 3.1.5. It provides functional exploit URLs for SQLi via union-based injection in view.php and edit.php, and XSS via the 'group' parameter in index.php.
Description
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) edit.php or (2) import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector is already covered by CVE-2008-2565.2.
Exploits (1)
The exploit demonstrates SQL injection and XSS vulnerabilities in PHP-Address Book <= 3.1.5. It provides functional exploit URLs for SQLi via union-based injection in view.php and edit.php, and XSS via the 'group' parameter in index.php.