CVE-2013-0135
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 3.0%
from disclosure to weapon0 days
Published on NVDApr 9
1st PoCApr 5
exploitation probability
3.0%top 14% of all CVEs
observed exploitation
nono source reports it
12 public exploit(s)
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
Affected products
n/a · n/apublic PoCs found — 12✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38433exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38435exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38434exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38425exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38426exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38427exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38428exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38429exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38430exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38431exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/38432cve_referencepacketstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.