PHP iAddressBook Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	19845
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 02 2006 12:00AM
Updated:	Sep 06 2006 10:53PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Clemens Wacha PHP iAddressBook 0.95 Clemens Wacha PHP iAddressBook 0.94 Clemens Wacha PHP iAddressBook 0.93 Clemens Wacha PHP iAddressBook 0.92 Clemens Wacha PHP iAddressBook 0.91a Clemens Wacha PHP iAddressBook 0.91 Clemens Wacha PHP iAddressBook 0.9
Not Vulnerable:	Clemens Wacha PHP iAddressBook 0.96

PHP iAddressBook Unspecified Cross-Site Scripting Vulnerability

PHP iAddressBook is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PHP iAddressBook 0.95 and prior versions are vulnerable.

PHP iAddressBook Unspecified Cross-Site Scripting Vulnerability

Attackers can exploit this issue via a web client.

PHP iAddressBook Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released version 0.96 to address this issue; please see the reference section for details.

PHP iAddressBook Unspecified Cross-Site Scripting Vulnerability

References:

• PHP iAddressBook homepage (Clemens Wacha)
  
• Version 0.96 (2006-09-02) (Clemens Wacha)