Secunia

Several vulnerabilities have been reported in more.groupware, which can be exploited by malicious users to conduct Cross-Site Scripting attacks against users and upload malicious files.

Reportedly, many pages in more.groupware doesn't validate user input properly. This can be exploited to disclose various information (eg. cookie-based authentication information) associated with the site running more.groupware or inclusion of malicious content, which a user could think is part of the real website.

It has also been reported that a malicious user may be able to upload arbitrary files to the system and then execute them.

The vulnerabilities have been reported in version 0.6.7 but prior versions may also be affected. Furthermore, version 0.6.8 is due to be released soon but will NOT include fixes.

Solution
Update to version 0.6.9:
Further details available in Customer Area

Provided and/or discovered by
François Sorin

Changelog
Further details available in Customer Area

Original Advisory
http://www.security-corporation.com/articles-20030626-003.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area