{"type": "osvdb", "published": "2006-08-21T11:03:57", "href": "https://vulners.com/osvdb/OSVDB:28172", "bulletinFamily": "software", "cvss": {"vector": "NONE", "score": 0.0}, "viewCount": 0, "edition": 1, "reporter": "OSVDB", "title": "PHP iAddressBook q Form Field XSS", "affectedSoftware": [{"operator": "eq", "version": "0.91", "name": "PHP iAddressBook"}, {"operator": "eq", "version": "0.9", "name": "PHP iAddressBook"}, {"operator": "eq", "version": "0.93", "name": "PHP iAddressBook"}, {"operator": "eq", "version": "0.91a", "name": "PHP iAddressBook"}, {"operator": "eq", "version": "0.92", "name": "PHP iAddressBook"}], "enchantments": {"score": {"value": -0.1, "vector": "NONE", "modified": "2017-04-28T13:20:24", "rev": 2}, "dependencies": {"references": [], "modified": "2017-04-28T13:20:24", "rev": 2}, "vulnersScore": -0.1}, "references": [], "id": "OSVDB:28172", "lastseen": "2017-04-28T13:20:24", "cvelist": [], "modified": "2006-08-21T11:03:57", "description": "## Vulnerability Description\nPHP iAddressBook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'q' form field upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 0.94 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nPHP iAddressBook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'q' form field upon submission to an unspecified script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## References:\nVendor URL: http://wacha.ch/wiki/addressbook\nVendor Specific News/Changelog Entry: http://wacha.ch/wiki/addressbook:changelog\n[Secunia Advisory ID:21610](https://secuniaresearch.flexerasoftware.com/advisories/21610/)\n[Related OSVDB ID: 28173](https://vulners.com/osvdb/OSVDB:28173)\n"}

{}