CVE-2025-63737
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-12
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rockoa | rockoa | 2.7.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by testing the /task.php endpoint with the parameters m=cli|runt and a=urltest, injecting payloads into the id and id2 parameters to see if they are reflected unsanitized. For example, you can use curl to send a request with a payload that triggers JavaScript execution, such as: curl 'http://<target-ip>:<port>/task.php?m=cli|runt&a=urltest&id=<img src=x onerror=alert(1)>&id2=<img src=x onerror=alert(2)>' and observe if the response contains the injected script tags without sanitization. This indicates the presence of the XSS vulnerability. [1]
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) issue in the urltestAction function within the cliAction.php file of Xinhu Rainrock RockOA 2.7.0. It allows remote attackers to inject arbitrary web scripts or HTML by manipulating the 'm' parameter in requests to the task.php endpoint.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute malicious scripts in the context of the affected web application, potentially leading to theft of user credentials, session hijacking, defacement, or other malicious actions impacting users and the integrity of the application.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the /task.php endpoint with the vulnerable parameters, applying input validation and output encoding to the id and id2 parameters in the urltestAction function to prevent script injection, or updating to a patched version of Xinhu Rainrock RockOA if available. As a temporary measure, you can also implement web application firewall (WAF) rules to block requests containing suspicious script tags in these parameters. [1]