SohuTV CacheCloud Cross-Site Scripting Vulnerability in Quartz Management Controller

A cross-site scripting (XSS) vulnerability has been identified in SohuTV CacheCloud versions up to 3.2.0. The issue arises in the Quartz Management Controller, specifically within the 'doQuartzList' function. The vulnerability allows for remote exploitation, as user-controlled parameters are not properly encoded before being displayed on the web page, enabling attackers to inject malicious scripts that could be executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to the '/manage/quartz/list' endpoint with a payload that includes a script injection, such as an alert() call, in the 'query' parameter. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.