OA-system backend addandchangeday#title interface XSS vulnerability

Vulnerability Product: 程序员二师兄/oasys
Vulnerability version: before 2025.01.01
Vulnerability type: XSS vulnerability
Vulnerability Details：
1. By analyzing cn/gson/oass/controller/daymanager/daymanageability Controller. java: 181, it was found that in the addandchangeday() method, the ScheduleList object received the request parameter scheduleList from the client, and continued to store the scheduleList data directly in the database in cn/gson/oass/controller/daymanagement/Daymanageability Controller. java: 200 before returning it to the/daymanagement route.
![输入图片说明](https://foruda.gitee.com/images/1741417252003218655/2d5efac9_14000209.png "屏幕截图")
2. Continuing to analyze the addandchangeday object, it can be found that the title parameter in cn/gson/oases/model/entity/schedule/scheduleList. java: 50 belongs to the String type, and the downward path cn/gson/oases/model/entity/schedule/scheduleList. java: 189 confirms that it contains multiple parameters that can be directly input by the client, without filtering or escaping these parameters throughout the process.
![输入图片说明](https://foruda.gitee.com/images/1741417286659750191/0379c6bd_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741417308158762446/2a0efe77_14000209.png "屏幕截图")
3. Continuing to analyze/daymanage routing, store the obtained Schedule List object list in the template on the cn/gson/oasys/controller/daymanagement/Daymanagement Controller. java: 72 path, and access and display the information of Schedule List objects through the "schedules" key. Finally, return all data to the daymanagement/daymanagement view template.
![输入图片说明](https://foruda.gitee.com/images/1741417312049726545/61c621c3_14000209.png "屏幕截图")
4. Continue to pass data to the daymanagement paging. ftl template file in the templates/daymanagement/daymanagement view template at 28.
![输入图片说明](https://foruda.gitee.com/images/1741417324082359179/3ce0a02f_14000209.png "屏幕截图")
5. After arriving at the template file, the ${(schedule. title)! ''} path of templates/daymanagement/daymanagement paging. ftl: 45 directly concatenates the title parameter value of the client-side string, without compiling or escaping the title throughout the process. Therefore, XSS vulnerabilities can be triggered through the title parameter.
![输入图片说明](https://foruda.gitee.com/images/1741417340309861281/15c0b0b9_14000209.png "屏幕截图")
6. Construct POC, log in and capture packets.

```
http://127.0.0.1:18089/addandchangeday?describe=1&endTime=2024-05-08+12%3A14%3A10&rcId=&shareuser=%E6%9C%B1%E4%B8%BD%E5%8F%B6&startTime=2024-05-07+12%3A14%3A10&statusId=27&title=<script>prompt("XSS-addandchangeday:title")</script>&typeId=45
```
![输入图片说明](https://foruda.gitee.com/images/1741417397489680946/598e77a2_14000209.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1741417412144036069/b85480a7_14000209.png "屏幕截图")

hailey/oasys

内容风险标识

评论 (1)

hailey/oasys .gitee-modal { width: 500px !important; }

内容风险标识