CVE-2025-9737
BaseFortify
Publication date: 2025-08-31
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zoneland | o2oa | to 10.0-410 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-9737 is a stored cross-site scripting (XSS) vulnerability in the o2oa application up to version 10.0-410. It occurs in the endpoint /x_query_assemble_designer/jaxrs/importmodel, where user input in fields like description, applicationName, and queryName is not properly sanitized before being stored and later rendered. This allows attackers to inject malicious scripts that execute persistently when the affected data is viewed, potentially compromising users who interact with the application. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to persistent execution of malicious JavaScript in users' browsers, which may result in theft of session tokens or sensitive information, unauthorized actions performed on behalf of authenticated users, and compromise of the integrity of the affected system. Remote attackers can exploit this without local access, but user interaction is required to trigger the malicious scripts. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the endpoint `/x_query_assemble_designer/jaxrs/importmodel` with payloads containing malicious scripts in fields such as `description`, `applicationName`, and `queryName`. For example, you can use curl to send a JSON payload with an XSS vector like `<img src=1 onerror=alert(1)>` in these fields and observe if the script executes when the affected profile or data is viewed. Example command: curl -X POST -H "Content-Type: application/json" -d '{"description":"<img src=1 onerror=alert(1)>", "applicationName":"test", "queryName":"test"}' https://[target]/x_query_assemble_designer/jaxrs/importmodel. Monitoring HTTP traffic for such requests or responses containing unsanitized script tags can also help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include filtering and escaping all user inputs in the affected profile fields (`description`, `applicationName`, `queryName`) before storing them, and applying proper output encoding when rendering this data in the application interface. Until a fixed version is released by the vendor, consider restricting access to the vulnerable endpoint, monitoring for suspicious POST requests, and possibly using web application firewalls (WAF) to block malicious payloads. Additionally, consider using alternative products or versions not affected by this vulnerability. [2, 3]