Stored script execution via unsanitized admin fields

Stored XSS in Collabtive 3.1 allows remote authenticated users with administrative access to execute script in another user's browser. The admin.php handlers for action=system and action=addcust store the name, company, and contact parameters without neutralizing HTML attribute input, then render the stored values so an autofocus/onfocus payload executes when an administrator views the affected page. Administrative access is required to save the payload, and another user's interaction is required; successful exploitation can read or modify data accessible to that browser session.