Mindskip xzs-mysql CORS Misconfiguration Vulnerability

A vulnerability exists in Mindskip xzs-mysql 学之思开源考试系统 version 3.9.0, specifically within the CORS Handler component. This vulnerability allows for a permissive cross-domain policy that can be exploited by untrusted domains. The issue can be exploited remotely, but the complexity of the attack is high, requiring some form of user interaction. While the vulnerability has been publicly disclosed and a proof-of-concept exploit is available, technical details on the exploitation are not specified.

Impact

The vulnerability leads to an overly permissive cross-domain policy, allowing untrusted domains to interact with the application in ways that could compromise its integrity.