CVE-2020-37083: PHP AddressBook SQLi Vulnerability

CVE-2020-37083 Overview

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the id parameter. Attackers can inject crafted SQL statements with time delays to extract information by observing response times in the photo.php endpoint. This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive database information, potentially including user credentials, contact details, and other confidential data stored in the PHP AddressBook application without authentication.

Affected Products

• PHP AddressBook version 9.0.0.1

Discovery Timeline

• 2026-02-03 - CVE CVE-2020-37083 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2020-37083

Vulnerability Analysis

This vulnerability exists in the photo.php endpoint of PHP AddressBook 9.0.0.1, where user-supplied input to the id parameter is not properly sanitized before being incorporated into SQL queries. The time-based blind SQL injection technique allows attackers to infer information from the database by observing whether time delays occur in the server's response.

Unlike error-based or union-based SQL injection, time-based blind injection does not rely on visible error messages or direct data output. Instead, attackers craft payloads that cause the database to pause execution for a specified duration when certain conditions are true, allowing them to extract data one character at a time by measuring response times.

Root Cause

The root cause of this vulnerability is the lack of proper input validation and sanitization of the id parameter in the photo.php script. The application directly incorporates user input into SQL queries without using parameterized queries or prepared statements, allowing malicious SQL code to be injected and executed by the database server.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. An attacker can send specially crafted HTTP requests to the photo.php endpoint with malicious SQL payloads in the id parameter. By injecting time-delay functions such as SLEEP() (MySQL) or WAITFOR DELAY (SQL Server), the attacker can determine whether specific conditions are true based on whether the server response is delayed.

For example, an attacker could construct payloads that cause delays only when a specific character in a database value matches their guess. By iterating through characters and measuring response times, they can systematically extract usernames, passwords, and other sensitive data from the database.

Technical details and proof-of-concept information are available in the Exploit-DB #48416 advisory and the VulnCheck SQL Injection Advisory.

Detection Methods for CVE-2020-37083

Indicators of Compromise

• Unusual HTTP requests to photo.php containing SQL syntax in the id parameter
• Requests with time-delay SQL functions such as SLEEP(), BENCHMARK(), or WAITFOR DELAY
• Multiple sequential requests to the same endpoint with incrementally modified parameters
• Abnormally long response times for requests to photo.php

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in request parameters
• Monitor application logs for requests containing SQL keywords like SELECT, UNION, SLEEP, BENCHMARK, or WAITFOR
• Enable database query logging and alert on suspicious query patterns or syntax errors
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attempts

Monitoring Recommendations

• Set up alerts for requests to photo.php with unusually long processing times
• Monitor for high-volume requests from single IP addresses targeting the vulnerable endpoint
• Review web server access logs for patterns indicative of automated SQL injection tools
• Implement response time anomaly detection to identify time-based injection attempts

How to Mitigate CVE-2020-37083

Immediate Actions Required

• Restrict access to the photo.php endpoint through firewall rules or web server configuration
• Implement input validation to reject requests with suspicious characters in the id parameter
• Consider disabling the PHP AddressBook application until a patched version is available
• Review database access logs for evidence of prior exploitation attempts

Patch Information

No official patch information is currently available from the vendor. Users should monitor the SourceForge Project Page for security updates. Consider implementing the workarounds below until an official fix is released.

Workarounds

• Apply strict input validation to ensure the id parameter only accepts numeric values
• Implement parameterized queries or prepared statements in the photo.php script to prevent SQL injection
• Deploy a Web Application Firewall (WAF) with SQL injection protection enabled
• Restrict network access to the application to trusted IP addresses only
• Consider migrating to a more actively maintained address book solution

# Apache configuration to restrict access to photo.php
<Location /photo.php>
    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24
</Location>