eGroupware Multiple Vulnerabilities
Vendor: eGroupware
Product: eGroupware
Version: <= 1.0.0.006
Website: http://www.egroupware.org/
BID: 13212
CVE: CVE-2005-1202 CVE-2005-1203
OSVDB: 15649 15750 15751 15752 15753
SECUNIA: 14982
PACKETSTORM: 37793
Description:
eGroupware is a very popular open source web based collaboration software that can be used within an intranet, or externally via the internet to build a community and/or help coordinate large projects. eGroupware also comes pre packaged in some linux distributions. GulfTech Security Research has found a few high risk SQL Injection vulnerabilities as well as Cross Site Scripting vulnerabilities. A new version of eGroupware is now available and all eGroupware users should upgrade immediately. Not only does the new eGroupware release address these security issues, but it also includes a number of important bugfixes!


Cross Site Scripting:
Cross site scripting exists in eGroupware. This vulnerability exists due to user supplied input not being checked properly. Below are examples that can be used for reference.

http://egroupware/index.php?menuaction=addressbook.uiaddressbook.edit&ab_id=11[XSS]
http://egroupware/index.php?menuaction=manual.uimanual.view&page=ManualAddressbook[XSS]
http://egroupware/index.php?menuaction=forum.uiforum.post&type=new[XSS]
http://egroupware/wiki/index.php?page=RecentChanges[XSS]
http://egroupware/wiki/index.php?action=history&page=WikkiTikkiTavi&lang=en[XSS]
http://egroupware/index.php?menuaction=wiki.uiwiki.edit&page=setup[XSS]
http://egroupware/sitemgr/sitemgr-site/?category_id=4[XSS]

This vulnerability could be used to steal cookie based authentication credentials within the scope of the current domain, or render hostile code in a victim's browser.


SQL Injection:
There are a number of SQL Injection vulnerabilities in eGroupware. These issues can be used by an attacker to retrieve sensitive information from the underlying database and aid in further attacks. Examples below

http://egroupware/tts/index.php?filter=u99[SQL]
http://egroupware/tts/index.php?filter=c99[SQL]
http://egroupware/index.php?menuaction=preferences.uicategories.index&cats_app=foobar[SQL]

We will not be releasing any exploited code as requested by the developers but these issues are not hard to exploit and all users should upgrade immediately.


Solution:
eGroupware 1.0.0.007 has been released to address these issues, and users can finfd the updated packages at the following location.

http://www.egroupware.org/

Special thanks to Mr Ralf Becker and the rest of the eGroupware team for addressing these issues fairly quickly despite the recent constitution and admin elections etc.


Credits:
James Bercegay of the GulfTech Security Research Team