CVE-2025-15146
Cross-Site Scripting in SohuTV CacheCloud UserManageController
Publication date: 2025-12-28
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sohutv | cachecloud | 3.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SohuTV CacheCloud up to version 3.2.0, specifically in the doUserList function of the UserManageController.java file. It allows an attacker to perform cross-site scripting (XSS) attacks by manipulating this function. The attack can be initiated remotely, and the exploit is publicly available.
How can this vulnerability impact me? :
The vulnerability can lead to cross-site scripting attacks, which may allow attackers to execute malicious scripts in the context of a user's browser. This can result in unauthorized actions, such as stealing session tokens, defacing web content, or redirecting users to malicious sites. However, the CVSS scores indicate a relatively low severity with limited impact on confidentiality and availability, but some impact on integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the vulnerable endpoint `/manage/user/list` for reflected Cross-Site Scripting (XSS) by injecting malicious payloads into the parameters `searchChName` and `searchBizName`. A practical detection method is to send crafted HTTP POST requests with XSS payloads in these parameters and observe if the payload is reflected unencoded in the response. For example, using curl or Python requests to send a payload such as `<input autofocus onfocus=alert('zast-xss')>` in `searchChName` and checking if the alert triggers or if the payload appears in the response HTML unescaped. A sample curl command might be: `curl -X POST -d "searchChName=<script>alert('xss')</script>&searchBizName=test" https://target/manage/user/list -H "Content-Type: application/x-www-form-urlencoded"` and then inspecting the response for the injected script. Monitoring web server logs for suspicious payloads targeting these parameters can also help detect exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Avoid using the vulnerable version of SohuTV CacheCloud (up to 3.2.0) and upgrade to a version where this vulnerability is fixed if available. 2) If upgrading is not possible, implement input validation and output encoding on the parameters `searchChName` and `searchBizName` to neutralize malicious scripts before rendering them in the web page. 3) Apply web application firewall (WAF) rules to detect and block malicious payloads targeting the `/manage/user/list` endpoint. 4) Restrict access to the vulnerable endpoint to trusted users only, since exploitation requires authentication. 5) Monitor logs for suspicious activity related to these parameters. Since the project has not responded with a patch yet, consider replacing the software with an alternative if feasible. [2, 3]