CVE-2025-9683 in O2OA
Summary
by MITRE • 08/30/2025
A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_cms_assemble_control/jaxrs/form of the component Personal Profile Page. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. The vendor replied in the GitHub issue (translated from simplified Chinese): "This issue will be fixed in the new version."
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2025
CVE-2025-9683 represents a cross site scripting vulnerability within the O2OA platform version 10.0-410 and earlier, specifically affecting the personal profile page functionality. This vulnerability exists within the file path x_cms_assemble_control/jaxrs/form which handles user profile data processing and rendering. The flaw allows attackers to inject malicious scripts into the application's response, potentially compromising user sessions and enabling unauthorized access to sensitive information. The vulnerability's remote exploitation capability means that attackers can trigger the XSS payload without requiring physical access to the system or direct user interaction beyond visiting a maliciously crafted URL. The public availability of exploit code significantly increases the risk profile, as threat actors can readily leverage this vulnerability to target unsuspecting users within the O2OA environment. This issue aligns with CWE-79 which categorizes cross site scripting flaws as weaknesses in input validation and output encoding, where insufficient sanitization of user-supplied data allows malicious code execution in the context of the victim's browser. The attack vector operates through the manipulation of parameters within the form processing endpoint, where user input is not properly escaped or validated before being rendered back to the browser. This vulnerability impacts the integrity and confidentiality of user data within the CMS environment, potentially allowing attackers to steal session cookies, redirect users to malicious sites, or execute arbitrary commands on behalf of authenticated users. The affected component's role in handling personal profile information makes it particularly sensitive, as successful exploitation could lead to unauthorized access to user credentials, personal data, or administrative functions. The vendor's acknowledgment through GitHub indicates that a fix is planned for future releases, but organizations must implement immediate mitigations given the public exploit availability. The vulnerability demonstrates weaknesses in the application's security architecture that could be addressed through proper input validation, output encoding, and Content Security Policy implementation. Organizations should consider implementing web application firewalls, monitoring for suspicious requests to the affected endpoint, and conducting security assessments of all user-facing form processing components. The risk assessment should include evaluating whether user profile data could be used to escalate privileges or access additional system resources beyond the immediate XSS impact. This vulnerability also aligns with ATT&CK technique T1566 which covers social engineering tactics through malicious payloads, specifically targeting user interaction with compromised applications. Given the nature of the vulnerability, organizations should prioritize patching the affected system while implementing additional security controls such as strict input validation, output encoding, and regular security scanning of all web applications. The public exploit availability necessitates immediate action regardless of the typical risk assessment timeline, as the vulnerability could be actively exploited in the wild.