Handy Address Book Server Cross-Site Scripting Vulnerability

Bugtraq ID:	14818
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 13 2005 12:00AM
Updated:	Sep 13 2005 12:00AM
Credit:	fRoGGz is credited with the discovery of this vulnerability.
Vulnerable:	Handy Address Book Handy Address Book Server 1.1 Handy Address Book Handy Address Book Server 1.0
Not Vulnerable:	Handy Address Book Handy Address Book Server 1.2

Handy Address Book Server Cross-Site Scripting Vulnerability

Handy Address Book Server is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Handy Address Book Server Cross-Site Scripting Vulnerability

No exploit is required.

Handy Address Book Server Cross-Site Scripting Vulnerability

Solution:
The vendor has addressed this issue in Handy Address Book Server version 1.2:


Handy Address Book Handy Address Book Server 1.0

• Handy Address Book AHABS12.exe
  http://www.handyaddressbook.com/downloads/AHABS12.exe

Handy Address Book Handy Address Book Server 1.1

• Handy Address Book AHABS12.exe
  http://www.handyaddressbook.com/downloads/AHABS12.exe

Handy Address Book Server Cross-Site Scripting Vulnerability

References:

• Handy Address Book Server Web Site (Handy Address Book Server)