CVE-2026-36460: ADPhonebook XSS Vulnerability

CVE-2026-36460 Overview

CVE-2026-36460 is a stored Cross-Site Scripting (XSS) vulnerability affecting Dovestones Software ADPhonebook versions prior to 4.0.1.1. The /Admin/Save API endpoint allows authenticated administrators to persist JavaScript payloads across multiple configuration sections. The application performs neither input validation nor output encoding on the submitted values. Stored payloads execute in the browser context of any user who subsequently loads the affected administrative views.

Critical Impact
An authenticated administrator can inject persistent JavaScript that executes in other users' sessions, enabling session hijacking, credential theft, and administrative action abuse against the ADPhonebook directory application [CWE-79].

Affected Products

Dovestones Software ADPhonebook versions prior to 4.0.1.1

Discovery Timeline

2026-06-03 - CVE-2026-36460 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-36460

Vulnerability Analysis

ADPhonebook is an Active Directory phone book application that exposes administrative configuration through a web interface. The /Admin/Save API accepts configuration values submitted by authenticated administrators and writes them to persistent storage. The endpoint accepts arbitrary string content across multiple configuration sections without filtering script-bearing characters or HTML markup.

When the stored configuration is later rendered into administrative pages, the application emits the values directly into the response without HTML entity encoding. A payload such as a <script> tag or an event handler attribute embedded in a configuration field is interpreted by the browser as executable code. Because the data persists server-side, the payload executes every time a user with access to the configuration views loads the page.

Root Cause

The root cause is missing input validation on the /Admin/Save API combined with absent contextual output encoding in the rendering layer. Configuration values intended as plain text are treated as raw HTML when written back to the document object model.

Attack Vector

Exploitation requires authenticated administrative access. An attacker with admin credentials, or one who compromises an admin account, submits a JavaScript payload through /Admin/Save targeting a configuration section. The payload triggers in the browser of any administrator who subsequently views the affected configuration. Public proof-of-concept code is available in a GitHub Gist demonstrating the injection pattern.

The vulnerability mechanism is described in prose because no verified vendor patch code is available. See the Dovestones Download Page for the fixed release.

Detection Methods for CVE-2026-36460

Indicators of Compromise

HTTP POST requests to /Admin/Save containing <script>, javascript:, onerror=, onload=, or onmouseover= substrings in the request body.
Configuration records in the ADPhonebook backing store containing HTML tags or JavaScript event handler attributes.
Outbound browser requests from administrator workstations to attacker-controlled hosts immediately after loading ADPhonebook admin pages.

Detection Strategies

Inspect web server access logs for POST /Admin/Save entries and correlate with the authenticated user, source IP, and submitted payload size.
Query the configuration store directly for known XSS sentinel strings such as <script, onerror=, and String.fromCharCode.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts inside the admin interface.

Monitoring Recommendations

Alert on any administrative configuration change followed by anomalous JavaScript execution telemetry from admin browsers.
Monitor for new or unexpected administrator account creation that could be used to stage the stored payload.
Track endpoint process telemetry on admin workstations for browser child processes spawning credential-access tooling after ADPhonebook sessions.

How to Mitigate CVE-2026-36460

Immediate Actions Required

Upgrade ADPhonebook to version 4.0.1.1 or later from the Dovestones Download Page.
Audit all configuration sections in ADPhonebook for existing HTML or script content and remove any unauthorized entries.
Rotate administrative credentials and invalidate active admin sessions following the upgrade.

Patch Information

Dovestones Software addresses the vulnerability in ADPhonebook 4.0.1.1. Administrators should download the patched release from the vendor and validate the upgrade in a staging environment before production rollout.

Workarounds

Restrict access to the /Admin/ path to a small set of trusted source IP addresses using a reverse proxy or web application firewall.
Configure a web application firewall rule to block requests to /Admin/Save whose body contains <script, javascript:, or HTML event handler patterns.
Enforce a strict Content Security Policy that disallows inline scripts on the administrative interface until the upgrade is applied.

bash

# Example WAF rule (ModSecurity) blocking script payloads to /Admin/Save
SecRule REQUEST_URI "@beginsWith /Admin/Save" \
    "phase:2,deny,status:403,id:1036460,\
    chain,msg:'CVE-2026-36460 ADPhonebook stored XSS attempt'"
    SecRule REQUEST_BODY "@rx (?i)(<script|javascript:|on(error|load|click|mouseover)\s*=)" "t:none"