Asterisk Trixbox CE Cross Site Scripting

`The asterisk phonebook module found in trixbox CE is vulnerable to an  
xss which can be triggered by importing a contact from a csv file like  
this:  
  
"/><script>alert(document.cookie);</script>";123123123;12313 FATAL ERROR  
  
url is $ip/admin/config.php?type=tool&display=phonebook  
So an import of a csv file which may contain untrusted data is now  
dangerous. (the above csv file example will result in your cookie  
being displayed when imported ^^).  
  
This really a bug in the asterisk phonebook module installing the  
module into asterisknow or freepbx will also mean that the xss can be  
used.  
However, it appears that trixbox ce is the only distribution to have  
the module installed out of the box.  
  
This post is for JshWright.  
  
--  
There's small choice in rotten apples. -- William Shakespeare, "The  
Taming of the Shrew"  
  
`