Title: Annuaire (Directory) HTML Injection Vulnerability
Severity: MODERATE
Description:
Annuaire (Directory) is web-based address book and directory application implemented in PHP.
Annuaire (Directory) is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. Specifically, user-supplied input to the 'COMMENTAIRE' parameter of 'inscription.php' isn't properly sanitized.
Attacker-supplied HTML and script code would be executed in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Affected Products:
- Annuaire Annuaire 1.0.0
References:
- Annuaire (Directory): Annuaire (Directory) Homepage