xss in trixbox ce (asterisk phonebook) via the contact page and import contacts (csv file).

[dave b <db.pub.mail () gmail com>]

The asterisk phonebook module found in trixbox CE is vulnerable to an
xss which can be triggered by importing a contact from a csv file like
this:

"/><script>alert(document.cookie);</script>";123123123;12313 FATAL ERROR

url is $ip/admin/config.php?type=tool&display=phonebook
So an import of a csv file which may contain untrusted data is now
dangerous. (the above csv file example will result in your cookie
being displayed when imported ^^).

This really a bug in the asterisk phonebook module installing the
module into asterisknow or freepbx will also mean that the xss can be
used.
However, it appears that trixbox ce is the only distribution to have
the module installed out of the box.

This post is for JshWright.

--
There's small choice in rotten apples.          -- William Shakespeare, "The
Taming of the Shrew"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/