BID:31168

Horde Turba Contact Manager '/imp/test.php' Cross Site Scripting Vulnerability

Info

Horde Turba Contact Manager '/imp/test.php' Cross Site Scripting Vulnerability

Bugtraq ID:	31168
Class:	Input Validation Error
CVE:	CVE-2008-4182
Remote:	Yes
Local:	No
Published:	Sep 14 2008 12:00AM
Updated:	May 07 2015 05:06PM
Credit:	Ivan Sanchez
Vulnerable:	S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 Horde Project Horde 3.2.2 Horde Project Horde 3.1.1 Horde Turba Contact Manager 2.2.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0

Not Vulnerable:

Discussion

Horde Turba Contact Manager '/imp/test.php' Cross Site Scripting Vulnerability

Turba Contact Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Note that this issue also affects Turba on Horde IMP.

Turba Contact Manager H3 2.2.1 is vulnerable; other versions may also be affected.

Exploit / POC

Horde Turba Contact Manager '/imp/test.php' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Solution / Fix

Horde Turba Contact Manager '/imp/test.php' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Debian Linux 4.0 amd64