Executive Summary

CVE-2025-9719 is a stored cross-site scripting (XSS) vulnerability in O2OA versions up to 10.0-410, specifically in the Personal Profile Page component. It occurs because user inputs in fields like name, alias, description, and applicationName are not properly sanitized before being stored and later rendered. This allows attackers to inject malicious scripts that execute persistently when other users view the affected profile page, potentially compromising user data and application integrity. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent execution of malicious JavaScript in the browsers of users who view the compromised profile pages. This can result in theft of session tokens, exposure of sensitive user data, and unauthorized actions performed on behalf of authenticated users. The attack can be executed remotely and requires some user interaction, making it a significant risk to data integrity and user security. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the vulnerable endpoint `/x_processplatform_assemble_designer/jaxrs/script` for stored cross-site scripting (XSS) by sending crafted POST requests with malicious script payloads in the fields name, alias, description, or applicationName. For example, you can use curl to send a JSON payload containing a script or an image tag with an onerror event to see if the script executes when the profile is viewed. Example command: curl -X POST -H "Content-Type: application/json" -d '{"name":"<img src=x onerror=alert(1)>"}' https://your-o2oa-instance/x_processplatform_assemble_designer/jaxrs/script. Monitoring HTTP traffic for suspicious payloads or unexpected script execution in user profiles can also help detect exploitation attempts. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include filtering and escaping user inputs in the affected profile fields (name, alias, description, applicationName) before storing them, and ensuring proper output encoding when rendering these fields to prevent script execution. If possible, consider disabling or restricting access to the vulnerable endpoint until a patch or update is available. Since no known countermeasures or official patches are identified, replacing the affected product or applying custom input sanitization and output encoding is recommended to reduce risk. [2, 3]

Useful 0 Not Useful 0