Group Office v3.6.5 - Multiple Web Vulnerabilities

Document Title:
===============
Group Office v3.6.5 - Multiple Web Vulnerabilities


References (Source):
====================
Group Office v3.6.5, v3.6.4, v3.6.3 & older versions


Release Date:
=============
2011-08-13


Vulnerability Laboratory ID (VL-ID):
====================================
117


Product & Service Introduction:
===============================
What is Group-Office?Group-Office suits a wide audience. It offers a very wide variety of features that matter. 
Features you don t need won t be installed. Group-Office stands out when it comes to user friendliness combined with powerfully features. 
It was developed with the following goals in mind: The World Wide Wait bugs us all every day and the critical business applications that 
Group-Office provides can t be hindered by being slow. Group-Office is specifically designed to perform tasks as quickly as possible.
The Graphical User Interface is designed in a way that everybody intuitively finds the functions they are looking for. Group-Office strives 
to be as simple as possible without losing functionality. As an ever-changing software product, upgrades should be as painless as possible. 
This means that good code design is critical. Group-Office is designed in a modular way that makes upgrades easy and painless.
Group-Office is designed to be usable for 1 to thousands of users. License GroupWare.

(Copy of the Vendor Website: details.php?scriptid=104&name=Group-Office)


Abstract Advisory Information:
==============================
Vulnerability-Lab Team discovered multiple Web Vulnerabilities on Group Office v3.6.5 content management system.


Vulnerability Disclosure Timeline:
==================================
2011-08-14:	Public or Non-Public Disclosure


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
Multiple persistent Input Validation Vulnerabilities are detected on Group-Office v3.6.x(Persistent).
Remote attackers or local low privileged user accounts can implement malicous persistent script codes on application-side.
The vulnerability type allows also to hijack customer application sessions or can result in the content manipulation of 
specific sections & areas.

Vulnerable Module(s):
						[+] Tasks - Administrator & Groupoffice
						[+] Calender - Appointment & Links
						[+] Summery Listing


Pictures:
						../1.png
						../2.png
						../3.png
						../4.png


Proof of Concept (PoC):
=======================
This vulnerabilities can be exploited by remote attackers or local low privileged user accounts.
For demonstration or reproduce ...


Code Review: Calender
<td colspan="2" class="display-panel-heading">>"<INSERT PERSISTENT SCRIPTCODE HERE!!!></td></tr><tr><td>Starts at:</t
d><td>31-03-2010</td></tr><tr><td>Due at:</td><td>31-03-2010</td></tr><tr><td&
gt;Status:</td><td>Accepted</td></tr></table></iframe></td>


Code Review: Summery
<div id="ext-gen1262" class="x-panel-bwrap  x-masked-relative x-masked"><div style="height: auto; width: 662px;" id="ext-gen1263" class="x-panel-body 
x-panel-body-noheader"><div id="ext-gen1276" class="x-grid3" hidefocus="true"><div id="ext-gen1277" class="x-grid3-viewport"><div id="ext-gen1278" 
class="x-grid3-header"><div id="ext-gen1285" class="x-grid3-header-inner"><div class="x-grid3-header-offset" style="width: 660px;"><table style="
width: 658px;" border="0" cellpadding="0" cellspacing="0"><thead><tr class="x-grid3-hd-row"><td class="x-grid3-hd x-grid3-cell x-grid3-td-ext-gen1111 
x-grid3-cell-first " style="width: 63px;"><div class="x-grid3-hd-inner x-grid3-hd-ext-gen1111" unselectable="on" style=""><a class="x-grid3-hd-btn" 
href="#"></a><div class="tasks-complete-icon"></div><img class="x-grid3-sort-icon" src="/groupoffice/ext/resources/images/default/s.gif"></div></td>
<td class="x-grid3-hd x-grid3-cell x-grid3-td-task-portlet-name-col " style="width: 218px;"><div class="x-grid3-hd-inner x-grid3-hd-task-portlet-name-col" 
unselectable="on" style=""><a style="height: 20px;" id="ext-gen1403" class="x-grid3-hd-btn" href="#"></a>Name<img class="x-grid3-sort-icon" 
src="/groupoffice/ext/resources/images/default/s.gif"></div></td><td class="x-grid3-hd x-grid3-cell x-grid3-td-2  sort-asc " style="width: 218px;">
<div class="x-grid3-hd-inner x-grid3-hd-2" unselectable="on" style=""><a style="height: 20px;" id="ext-gen5140" class="x-grid3-hd-btn" href="#"></a>
Due date<img class="x-grid3-sort-icon" src="/groupoffice/ext/resources/images/default/s.gif"></div></td><td class="x-grid3-hd x-grid3-cell x-grid3-td-3 
x-grid3-cell-last " style="width: 151px;"><div class="x-grid3-hd-inner x-grid3-hd-3" unselectable="on" style=""><a class="x-grid3-hd-btn" href="#">
</a>Tasklist<img class="x-grid3-sort-icon" src="/groupoffice/ext/resources/images/default/s.gif"></div></td></tr></thead></table></div></div>
<div class="x-clear"></div></div><div style="overflow: visible;" id="ext-gen1279" class="x-grid3-scroller"><div id="ext-gen1280" class="x-grid3-body" 
style="width: 658px;"><div class="x-grid3-row   tasks-late x-grid3-row-first x-grid3-row-last" style="width: 658px;"><table class="x-grid3-row-table" 
style="width: 658px;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td class="x-grid3-col x-grid3-cell x-grid3-td-ext-gen1111 x-grid3-cell-first  
x-grid3-check-col-td" style="width: 63px;" tabindex="0"><div class="x-grid3-cell-inner x-grid3-col-ext-gen1111" unselectable="on"><div class="x-grid3-check-col 
x-grid3-cc-ext-gen1111"> </div></div></td><td class="x-grid3-col x-grid3-cell x-grid3-td-task-portlet-name-col " style="width: 218px;" tabindex="0">
<div class="x-grid3-cell-inner x-grid3-col-task-portlet-name-col" unselectable="on">>"<INSERT PERSISTENT SCRIPTCODE HERE!!!>
</div></td><td class="x-grid3-col x-grid3-cell x-grid3-td-2 " style="width:220px;" tabIndex="0" ><div class="x-grid3-cell-inner 
x-grid3-col-2" unselectable="on" >31-03-2010</div></td><td class="x-grid3-col x-grid3-cell x-grid3-td-3 x-grid3-cell-last " style="width:153px;
" tabIndex="0" ><div class="x-grid3-cell-inner x-grid3-col-3" unselectable="on" >Administrator, Group-Office</div></td></
tr></tbody></table></div></iframe></div></td></tr></tbody></table></div></div><a style="left: 0px; top: 0px;" id="ext-gen1281" 
href="#" class="x-grid3-focus" tabindex="-1"></a></div></div><div id="ext-gen1283" class="x-grid3-resize-marker"> </div><div id="ext-gen1284" 
class="x-grid3-resize-proxy"> </div></div></div><div id="ext-gen5143" class="ext-el-mask"></div><div style="left: 289px; top: 13px;" id="ext-gen5144" 
class="ext-el-mask-msg x-mask-loading"><div>Loading...</div></div></div>


Security Risk:
==============
The security risk of the persistent vulnerabilities are estimated as medium.


Credits & Authors:
==================
Vulnerability Research Laboratory -  Pim Campers (X4lt)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory