Dovestones Software AD Phonebook versions prior to 4.0.1.1 contain a stored Cross-Site Scripting (XSS) vulnerability in the administrative configuration functionality. An authenticated administrator can inject malicious JavaScript payloads into multiple application configuration fields, which are subsequently rendered without proper input validation or output encoding.
Cross-Site Scripting (Stored XSS)
Dovestones Software AD Phonebook before version 4.0.1.1 is vulnerable to Stored Cross-Site Scripting (XSS) through the /Admin/Save functionality. The application allows authenticated administrative users to save configuration data containing arbitrary JavaScript payloads in multiple configuration sections without sufficient input validation or output encoding.
Injected payloads are stored by the application and executed when the affected configuration data is viewed or rendered by users. This may allow attackers to execute arbitrary JavaScript in the context of the application and compromise user sessions.
- Product: Dovestones Software AD Phonebook
- Versions Affected: Version 4.0.0.11 and earlier
- Fixed Version: 4.0.1.1
The vulnerability affects multiple configuration sections processed through the /Admin/Save endpoint, including:
- Search Filter
- Domain Mapping
- Details Section
- Column Data
- AD Directory Query
- General Settings
Successful exploitation may allow:
- Execution of arbitrary JavaScript within the application context
- Theft of session cookies or authentication tokens
- Session hijacking
- Administrative account compromise
- User impersonation
- Modification of application content presented to users
- Delivery of phishing content through trusted application pages
- Attack Type: Remote
- Vulnerability Class: Stored Cross-Site Scripting (Stored XSS)
- Authentication Required: Yes (Administrative privileges required)
- User Interaction Required: Yes (A victim must view the affected content)
- Attack Complexity: Low
Upgrade to Dovestones Software AD Phonebook version 4.0.1.1 or later.
The vendor has confirmed and acknowledged this vulnerability.
- Discovered by: Fedrick R. Sequeira (Accenture)
- Discovery Date: November 13, 2025