CVE-2020-37083 | THREATINT

Description

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint.

PUBLISHED Reserved 2026-02-01 | Published 2026-02-03 | Updated 2026-02-04 | Assigner VulnCheck

HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

9.0.0.1

affected

Credits

David Velazquez a.k.a. d4sh&r000 finder

References

www.exploit-db.com/exploits/48416 (ExploitDB-48416) exploit

sourceforge.net/projects/php-addressbook/ (SourceForge Product Page) product

www.vulncheck.com/advisories/addressbook-id-sql-injection (VulnCheck Advisory: addressbook 9.0.0.1 - 'id' SQL Injection) third-party-advisory

cve.org (CVE-2020-37083)

nvd.nist.gov (CVE-2020-37083)

Download JSON