Executive Summary

CVE-2025-9737 is a stored cross-site scripting (XSS) vulnerability in the o2oa application up to version 10.0-410. It occurs in the endpoint /x_query_assemble_designer/jaxrs/importmodel, where user input in fields like description, applicationName, and queryName is not properly sanitized before being stored and later rendered. This allows attackers to inject malicious scripts that execute persistently when the affected data is viewed, potentially compromising users who interact with the application. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent execution of malicious JavaScript in users' browsers, which may result in theft of session tokens or sensitive information, unauthorized actions performed on behalf of authenticated users, and compromise of the integrity of the affected system. Remote attackers can exploit this without local access, but user interaction is required to trigger the malicious scripts. [2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted POST requests to the endpoint `/x_query_assemble_designer/jaxrs/importmodel` with payloads containing malicious scripts in fields such as `description`, `applicationName`, and `queryName`. For example, you can use curl to send a JSON payload with an XSS vector like `<img src=1 onerror=alert(1)>` in these fields and observe if the script executes when the affected profile or data is viewed. Example command: curl -X POST -H "Content-Type: application/json" -d '{"description":"<img src=1 onerror=alert(1)>", "applicationName":"test", "queryName":"test"}' https://[target]/x_query_assemble_designer/jaxrs/importmodel. Monitoring HTTP traffic for such requests or responses containing unsanitized script tags can also help detect exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include filtering and escaping all user inputs in the affected profile fields (`description`, `applicationName`, `queryName`) before storing them, and applying proper output encoding when rendering this data in the application interface. Until a fixed version is released by the vendor, consider restricting access to the vulnerable endpoint, monitoring for suspicious POST requests, and possibly using web application firewalls (WAF) to block malicious payloads. Additionally, consider using alternative products or versions not affected by this vulnerability. [2, 3]

Useful 0 Not Useful 0