Executive Summary

CVE-2025-9718 is a stored cross-site scripting (XSS) vulnerability in the O2OA application up to version 10.0-410. It occurs in the Personal Profile Page component at the endpoint /x_processplatform_assemble_designer/jaxrs/process. The vulnerability arises because user-supplied inputs, such as the "name" or "alias" fields in personal profiles, are not properly sanitized before being stored and later rendered in the application. This allows an attacker to inject malicious JavaScript code that executes persistently when other users view the affected profile. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute persistent malicious scripts in the browsers of users who view the compromised profile. The impact includes theft of session tokens or sensitive data, and unauthorized actions performed on behalf of authenticated users. Because the malicious code executes in the context of the victim's browser, it can lead to account compromise or data leakage. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted POST requests to the endpoint `/x_processplatform_assemble_designer/jaxrs/process` with JSON payloads containing typical XSS attack vectors in fields such as "name" or "alias". For example, you can use curl to send a payload like: curl -X POST -H "Content-Type: application/json" -d '{"name":"<img src=1 onerror=alert(1)>"}' https://your-o2oa-instance/x_processplatform_assemble_designer/jaxrs/process and then check if the payload executes when viewing the affected profile page. Monitoring HTTP traffic for suspicious POST requests to this endpoint or scanning stored profile data for unsanitized scripts can also help detect exploitation attempts. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include filtering and escaping user inputs in the affected profile fields (such as "name" and "alias") before storing them, and applying proper output encoding when rendering these fields in the application. Since no official patch is currently available, consider restricting access to the vulnerable endpoint, monitoring for suspicious activity, and possibly replacing the affected component or product until a fixed version is released. [2, 3]

Useful 0 Not Useful 0