CVE-2013-0135

Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.

• CWE-89

• http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.htmlExploit
• http://www.acadion.nl/labs/advisory/20130203-phpaddressbook.htmlExploit
• http://www.kb.cert.org/vuls/id/183692Exploit, US Government Resource
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99623
• http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.htmlExploit
• http://www.acadion.nl/labs/advisory/20130203-phpaddressbook.htmlExploit
• http://www.kb.cert.org/vuls/id/183692Exploit, US Government Resource
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99623

Published

Apr 9, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-0129Multiple cross-site scripting (XSS) vulnerabilities in pd-ad…
• CVE-2013-0130Multiple buffer overflows in Core FTP before 2.2 build 1769 …
• CVE-2013-0131Buffer overflow in the NVIDIA GPU driver before 304.88, 310.…
• CVE-2013-0132The suexec implementation in Parallels Plesk Panel 11.0.9 co…
• CVE-2013-0133Untrusted search path vulnerability in /usr/local/psa/admin/…
• CVE-2013-0134Cross-site scripting (XSS) vulnerability in the web interfac…
• CVE-2013-0136Multiple directory traversal vulnerabilities in the EditDocu…
• CVE-2013-0137The default configuration of the Digital Alert Systems DASDE…
• CVE-2013-0138BitZipper 2013 before Update 1 allows remote attackers to ex…
• CVE-2013-0139The Arecont Vision AV1355DN MegaDome camera allows remote at…
• CVE-2013-0140SQL injection vulnerability in the Agent-Handler component i…
• CVE-2013-0141Directory traversal vulnerability in McAfee ePolicy Orchestr…