Diblei

GroupOffice allows authenticated users to persist arbitrary legacy settings for any `user id` through the 'index.php?r=core/saveSetting' endpoint. A client-side sink in the email module injects the `email font size` setting directly into JavaScript without escaping. A low-privileged authenticated user can exploit these issues by overwriting an administrator's `email font size` setting with a JavaScript payload, triggering stored Cross-Site Scripting (XSS)—a technique where malicious scripts are permanently stored on the target server—in the administrator's browser when the web client loads 'views/Extjs3/modulescripts.php'.

Group-Office is an enterprise customer relationship management and groupware tool. An authenticated SQL Injection vulnerability exists in the JMAP `Contact/query` endpoint. This allows any authenticated user with basic addressbook access to extract arbitrary data from the database, including active session tokens of other users. Successful exploitation enables full account takeover of any user, including the System Administrator, without knowing their password. The vulnerability affects the `Contact/query` API endpoint and allows access to data through SQL injection via the JMAP interface.