SohuTV CacheCloud Cross-Site Scripting Vulnerability in AppController

A cross-site scripting (XSS) vulnerability has been identified in SohuTV CacheCloud versions prior to 3.2.0. The issue resides in the AppController's 'doAppList' and 'appCommandAnalysis' functions, where user-controlled parameters are not properly encoded before being displayed on web pages. This flaw allows remote attackers to execute XSS attacks, potentially affecting users who interact with the compromised pages.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the '/admin/app/commandAnalysis' or '/admin/app/list' endpoint with a payload that includes unencoded script tags in the 'firstCommand' or 'appParam' parameter. The response will reflect the injected script, demonstrating the cross-site scripting vulnerability.