CVE-2020-37083: addressbook 9.0.0.1 - 'id' SQL Injection

Published Feb 3, 2026

Updated

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint.

Affected Software

1 affected component

PHP AddressBook

Event History

Feb 3, 2026

CVE Published

via MITRE·10:01 PM

Data Sourced

via MITRE·10:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-37083?

The severity of CVE-2020-37083 is classified as high due to its potential to allow unauthorized access to sensitive database information.

How do I fix CVE-2020-37083?

To fix CVE-2020-37083, you should sanitize and validate all user input on the 'id' parameter to prevent SQL injection.

What types of attacks can CVE-2020-37083 facilitate?

CVE-2020-37083 can facilitate time-based blind SQL injection attacks that allow attackers to extract data from the database.

Which software versions are affected by CVE-2020-37083?

CVE-2020-37083 affects PHP AddressBook version 9.0.0.1.

Can CVE-2020-37083 be exploited remotely?

Yes, CVE-2020-37083 can be exploited remotely by attackers manipulating the 'id' parameter.