OA-system backend informcheck#top interface XSS vulnerability

Vulnerability Product: 程序员二师兄/oasys
Vulnerability version: before 2025.01.01
Vulnerability type: XSS vulnerability
Vulnerability Details：
1. By analyzing cn/gson/oasys/controller/inform/InformManageController.java:259, it is found that in the testMess method, the NoticesList object receives request parameters menu from the client.
![输入图片说明](https://foruda.gitee.com/images/1741403018744615771/4b6170a5_14000209.png "屏幕截图")
2. Upon further analysis of the NoticesList object, it is determined at cn/gson/oasys/model/entity/notice/NoticesList.java:132 that it contains multiple parameters that can be directly input by the client. Throughout the entire process, these parameters are not filtered or escaped. Tracing upwards to cn/gson/oasys/model/entity/notice/NoticesList.java:38, it can be found that the top parameter is of the boolean type.
![输入图片说明](https://foruda.gitee.com/images/1741403037766555128/3f54148c_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741403060896842522/95aac6a7_14000209.png "屏幕截图")
3. Continuing the analysis, when the top parameter is mistakenly passed as a string type by the client, an error will be reported at cn/gson/oasys/controller/inform/InformManageController.java:271. This string is then stored in the current HTTP request as an attribute named "errormess". Simultaneously, at cn/gson/oasys/controller/inform/InformManageController.java:306, all data is passed to the infromEdit method of the informedit route.
![输入图片说明](https://foruda.gitee.com/images/1741403079355429481/678d536b_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741403096265342293/09e0ea88_14000209.png "屏幕截图")
4. In the infromEdit method, at cn/gson/oasys/controller/inform/InformManageController.java:209, there is a check to see if "errormess" exists in the request. Continuing further, at cn/gson/oasys/controller/inform/InformManageController.java:225, all data is returned to the "inform/informedit" view template.
�![输入图片说明](https://foruda.gitee.com/images/1741403112036468243/db984c03_14000209.png "屏幕截图")
5. Upon reaching the view template, an external template file is introduced at templates/inform/informedit.ftl:112. Further analysis of this file reveals that at templates/common/modalTip.ftl:96, the errormess element is invoked, and the following code executes, outputting both the error message and any user input containing attack statements. Throughout the entire process, the user input parameters are not filtered or escaped. When the top parameter is input with malicious code by the client, an XSS vulnerability exists.
![输入图片说明](https://foruda.gitee.com/images/1741403155859890431/f8994b10_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741403171467148498/11cc32aa_14000209.png "屏幕截图")
6. Construct a Proof of Concept (PoC), log in, capture the packet, and replace the cookie.

```
http://127.0.0.1:18089/informcheck?content=123&statusId=14&title=123&top="]"><script>alert("typeId")</script>&typeId=10&url=123
```

![输入图片说明](https://foruda.gitee.com/images/1741403192534708754/b0e5ac79_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741403207483473496/4aaa2aff_14000209.png "屏幕截图")

hailey/oasys

内容风险标识

评论 (1)

hailey/oasys .gitee-modal { width: 500px !important; }

内容风险标识