Document Title:
===============
Group Office v3.6.5 - Multiple Web Vulnerabilities
References (Source):
====================
Group Office v3.6.5, v3.6.4, v3.6.3 & older versions
Release Date:
=============
2011-08-13
Vulnerability Laboratory ID (VL-ID):
====================================
117
Product & Service Introduction:
===============================
What is Group-Office?Group-Office suits a wide audience. It offers a very wide variety of features that matter.
Features you don t need won t be installed. Group-Office stands out when it comes to user friendliness combined with powerfully features.
It was developed with the following goals in mind: The World Wide Wait bugs us all every day and the critical business applications that
Group-Office provides can t be hindered by being slow. Group-Office is specifically designed to perform tasks as quickly as possible.
The Graphical User Interface is designed in a way that everybody intuitively finds the functions they are looking for. Group-Office strives
to be as simple as possible without losing functionality. As an ever-changing software product, upgrades should be as painless as possible.
This means that good code design is critical. Group-Office is designed in a modular way that makes upgrades easy and painless.
Group-Office is designed to be usable for 1 to thousands of users. License GroupWare.
(Copy of the Vendor Website: details.php?scriptid=104&name=Group-Office)
Abstract Advisory Information:
==============================
Vulnerability-Lab Team discovered multiple Web Vulnerabilities on Group Office v3.6.5 content management system.
Vulnerability Disclosure Timeline:
==================================
2011-08-14: Public or Non-Public Disclosure
Discovery Status:
=================
Published
Affected Product(s):
====================
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Medium
Technical Details & Description:
================================
Multiple persistent Input Validation Vulnerabilities are detected on Group-Office v3.6.x(Persistent).
Remote attackers or local low privileged user accounts can implement malicous persistent script codes on application-side.
The vulnerability type allows also to hijack customer application sessions or can result in the content manipulation of
specific sections & areas.
Vulnerable Module(s):
[+] Tasks - Administrator & Groupoffice
[+] Calender - Appointment & Links
[+] Summery Listing
Pictures:
../1.png
../2.png
../3.png
../4.png
Proof of Concept (PoC):
=======================
This vulnerabilities can be exploited by remote attackers or local low privileged user accounts.
For demonstration or reproduce ...
Code Review: Calender
