CVE-2025-9718
BaseFortify
Publication date: 2025-08-31
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zoneland | o2oa | to 10.0-410 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9718 is a stored cross-site scripting (XSS) vulnerability in the O2OA application up to version 10.0-410. It occurs in the Personal Profile Page component at the endpoint /x_processplatform_assemble_designer/jaxrs/process. The vulnerability arises because user-supplied inputs, such as the "name" or "alias" fields in personal profiles, are not properly sanitized before being stored and later rendered in the application. This allows an attacker to inject malicious JavaScript code that executes persistently when other users view the affected profile. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability allows remote attackers to execute persistent malicious scripts in the browsers of users who view the compromised profile. The impact includes theft of session tokens or sensitive data, and unauthorized actions performed on behalf of authenticated users. Because the malicious code executes in the context of the victim's browser, it can lead to account compromise or data leakage. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the endpoint `/x_processplatform_assemble_designer/jaxrs/process` with JSON payloads containing typical XSS attack vectors in fields such as "name" or "alias". For example, you can use curl to send a payload like: curl -X POST -H "Content-Type: application/json" -d '{"name":"<img src=1 onerror=alert(1)>"}' https://your-o2oa-instance/x_processplatform_assemble_designer/jaxrs/process and then check if the payload executes when viewing the affected profile page. Monitoring HTTP traffic for suspicious POST requests to this endpoint or scanning stored profile data for unsanitized scripts can also help detect exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include filtering and escaping user inputs in the affected profile fields (such as "name" and "alias") before storing them, and applying proper output encoding when rendering these fields in the application. Since no official patch is currently available, consider restricting access to the vulnerable endpoint, monitoring for suspicious activity, and possibly replacing the affected component or product until a fixed version is released. [2, 3]