SohuTV CacheCloud Cross-Site Scripting Vulnerability in InstanceController

A cross-site scripting (XSS) vulnerability has been identified in SohuTV CacheCloud versions up to 3.2.0. The issue arises in the 'advancedAnalysis' function of the 'InstanceController.java' file, where user-controlled parameters are not properly encoded before being displayed on the web page. This flaw allows remote attackers to execute XSS attacks, targeting users of the application.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the '/admin/instance/advancedAnalysis' endpoint with the 'startDate' parameter containing a crafted payload that includes JavaScript code, and the 'endDate' parameter set to a valid date. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.