Description
PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| chatelao | PHP Address Book | 9.0.0.1 | — |
References
- ExploitDB-48416 exploit
- SourceForge Product Page product
- VulnCheck Advisory: addressbook 9.0.0.1 - 'id' SQL Injection third-party-advisory