ACollab 1.2 contains multiple flaws that allow remote script insertion, cross site request forgery, and cross site scripting.

1) XSS: Input passed to the "f" parameter in sign_in.php is not properly sanitised before being returned to the user.

2) Script insertion: Input passed to multiple parameters throughout the application is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in the context of an affected site when the malicious agenda item is displayed.

3) CSRF: The application allows users to perform certain actions via HTTP requests without performing any validation checks to verify the requests. This can be exploited to e.g. add new personal agenda items when a logged in user views a malicious web page.

References:

CVE-2009-pending

BID:

FrSIRT: N/A

Nessus:N/A

OSVDB: 54798 , 54799 , 54800 . 54801

SA: 35173

XF: 

Related: 

Vendor Solution: