Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck
CVE-2020-37083addressbook 9.0.0.1 - 'id' SQL Injection
High 8.2
In plain English
A high-severity SQL injection in PHP Address Book from chatelao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.4%top 70.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| chatelao | PHP Address Book | 9.0.0.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-48416 exploit
- SourceForge Product Page product
- VulnCheck Advisory: addressbook 9.0.0.1 - 'id' SQL Injection third-party-advisory