SohuTV CacheCloud Cross-Site Scripting Vulnerability in WebResourceController

A cross-site scripting (XSS) vulnerability has been identified in SohuTV CacheCloud versions up to 3.2.0. The issue arises in the WebResourceController, specifically within the redirectNoPower function. This vulnerability allows remote attackers to inject malicious scripts, which could be executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the '/web/resource/noPower' endpoint with an 'appId' parameter containing the injected script payload. The absence of proper input encoding in the response will demonstrate the XSS vulnerability.