PHP Address Book suffers from cross site scripting and remote SQL injection vulnerabilities, the latter allowing for authentication bypass.