GContact Multiple Cross-Site Scripting Vulnerabilities

Bugtraq ID:	20530
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 14 2006 12:00AM
Updated:	Jan 04 2007 06:26PM
Credit:	Armorize Technologies is credited with the discovery of these vulnerabilities.
Vulnerable:	Grégory PAUL GContact 0.6.5
Not Vulnerable:	Grégory PAUL GContact 0.6.6

GContact Multiple Cross-Site Scripting Vulnerabilities

GContact is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

GContact version 0.6.5 is vulnerable to these issues; other versions may also be affected.

GContact Multiple Cross-Site Scripting Vulnerabilities

An attacker can exploit these issues via a web client.

GContact Multiple Cross-Site Scripting Vulnerabilities

Solution:
The vendor has addressed these issues in version 0.6.6 and later.


Grégory PAUL GContact 0.6.5

• Grégory PAUL GContact-20061230-0.6.7.tar.gz
  http://downloads.sourceforge.net/gcontact/GContact-20061230-0.6.7.tar. gz

GContact Multiple Cross-Site Scripting Vulnerabilities

References:

• GContact Home Page (GContact)
  
• Security fixes on release 0.6.6 (GContact)
  
• Multiple XSS Vulnerability in Gcontact ([email protected])