OA-system backend informcheck#title interface XSS vulnerability

Vulnerability Product: 程序员二师兄/oasys
Vulnerability version: before 2025.01.01
Vulnerability type: XSS vulnerability
Vulnerability Details：
1. Upon analyzing cn/gson/oasys/controller/inform/InformManageController.java:259, it is found that within the testMess method, the NoticesList object receives the request parameter menu from the client.
![输入图片说明](https://foruda.gitee.com/images/1741402465064194246/3c97f57e_14000209.png "屏幕截图")
2. Further analysis of the NoticesList object at cn/gson/oasys/model/entity/notice/NoticesList.java:132 reveals that it contains multiple parameters that can be directly input by the client. Throughout the entire process, these parameters are not filtered or escaped. Tracing upwards to cn/gson/oasys/model/entity/notice/NoticesList.java:26, it can be found that the title parameter is of the String type.
![输入图片说明](https://foruda.gitee.com/images/1741402491596877110/968cbdff_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741402508591359914/3e87f2d8_14000209.png "屏幕截图")
3. Continuing the analysis, at cn/gson/oasys/controller/inform/InformManageController.java:306, all data is passed to the infromEdit method of the informedit route.
![输入图片说明](https://foruda.gitee.com/images/1741402524743636087/4854c2b9_14000209.png "屏幕截图")
4. In the infromEdit method at cn/gson/oasys/controller/inform/InformManageController.java:225, all data is returned to the "inform/informedit" view template.
![输入图片说明](https://foruda.gitee.com/images/1741402541417931086/593d92e5_14000209.png "屏幕截图")
5. Upon reaching the template at templates/inform/informedit.ftl:74, it is observed that the value ${(noticeList.title)!''} is not encoded or escaped in any form throughout the process. Further analysis is required to determine if there is any special handling of these parameters elsewhere.
![输入图片说明](https://foruda.gitee.com/images/1741402562938500380/f0a34519_14000209.png "屏幕截图")
6. Continuing the analysis in the view template, at templates/inform/informedit.ftl:112, an external template file named modalTip.ftl is introduced. Within the template framework at templates/common/modalTip.ftl:62, when the user clicks the "OK" button, it triggers the successToUrl element.
![输入图片说明](https://foruda.gitee.com/images/1741402578227009372/b53f0c88_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741402595238765084/9dbbeddb_14000209.png "屏幕截图")
7. Upon being triggered, it continues at templates/inform/informedit.ftl:115. When the user clicks on any element with the class name successToUrl, the browser will redirect to the /infrommanage page of the website.
![输入图片说明](https://foruda.gitee.com/images/1741402627663015398/8cb63688_14000209.png "屏幕截图")
8. Upon arriving at the /infrommanage page, in cn/gson/oasys/controller/inform/InformManageController.java:95, the noticeList form obtained earlier is directly passed to the template and returned to infrommanage. Throughout the entire process, there is no special compilation or escaping of parameters. Therefore, the title here is controllable, resulting in an XSS vulnerability.
![输入图片说明](https://foruda.gitee.com/images/1741402643404236140/679082c6_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741402657290808532/ff54e88a_14000209.png "屏幕截图")
9. Construct a Proof of Concept (PoC), capture packets during login, and replace the cookie.

```
http://127.0.0.1:18089/informcheck?content=123&statusId=14&title="]"><script>alert("title")</script>&top=&typeId=1&url=123
```

![输入图片说明](https://foruda.gitee.com/images/1741402731487851996/794ffcf0_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741402752455242612/4e8215f7_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741402775292155383/9204afe2_14000209.png "屏幕截图")

hailey/oasys

Content Risk Flag

Comments (1)

hailey/oasys .gitee-modal { width: 500px !important; }

Content Risk Flag