The asterisk phonebook module found in trixbox CE is vulnerable to an xss which can be triggered by importing a contact from a csv file like this: "/>";123123123;12313 FATAL ERROR url is $ip/admin/config.php?type=tool&display=phonebook So an import of a csv file which may contain untrusted data is now dangerous. (the above csv file example will result in your cookie being displayed when imported ^^). This really a bug in the asterisk phonebook module installing the module into asterisknow or freepbx will also mean that the xss can be used. However, it appears that trixbox ce is the only distribution to have the module installed out of the box. This post is for JshWright. -- There's small choice in rotten apples. -- William Shakespeare, "The Taming of the Shrew" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/