Executive Summary

CVE-2025-9680 is a stored cross-site scripting (XSS) vulnerability in the O2OA application up to version 10.0-410. It occurs in the endpoint /x_portal_assemble_designer/jaxrs/page, where user inputs in personal profile fields (such as name, alias, description, and category) are not properly sanitized before being stored and later rendered. This allows attackers to inject malicious scripts that persist and execute in the browsers of users who view the affected pages. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent execution of malicious JavaScript in users' browsers, potentially resulting in theft of session tokens, exposure of sensitive user data, and unauthorized actions performed on behalf of authenticated users. Attackers can remotely exploit this flaw by sending crafted requests, and the malicious scripts execute when victims view the compromised profile pages. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the vulnerable endpoint `/x_portal_assemble_designer/jaxrs/page` for stored cross-site scripting (XSS) by sending crafted POST requests containing typical XSS payloads in user profile fields such as "name," "alias," "description," and "category." For example, using curl to send a JSON payload with a script injection like `"><img src=1 onerror=alert(1)>` can help verify if the input is stored and executed. A sample command to test might be: curl -X POST https://target/o2oa/x_portal_assemble_designer/jaxrs/page -H "Content-Type: application/json" -d '{"name":""><img src=1 onerror=alert(1)>", "alias":"test", "description":"test", "category":"test"}' If the script executes when viewing the profile page, the vulnerability is present. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include filtering and escaping user inputs in the affected profile fields before storage and ensuring proper output encoding when rendering these fields in the application interface to prevent script execution. Since the vendor has acknowledged the issue and plans to fix it in a future version, users should consider restricting access to the vulnerable endpoint, applying input validation at the application or web server level, and monitoring for suspicious activity. If possible, temporarily disabling or limiting the use of the Personal Profile Page component until a patch is released is advisable. [2, 3]

Useful 0 Not Useful 0