We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2020-37083

CVE-2020-37083

PHP

Severity: HIGH
CVSS: 8.2CVSS
Published: 2026-02-03
Last modified: 2026-02-04
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE: CWE-89

Description

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint.

References

https://sourceforge.net/projects/php-addressbook/
https://www.exploit-db.com/exploits/48416
https://www.vulncheck.com/advisories/addressbook-id-sql-injection

Summary

Description

References