O2OA Cross-Site Scripting Vulnerability in Meetings Settings

A cross-site scripting (XSS) vulnerability has been identified in O2OA version 9.1.3, specifically within the Meetings - Settings section. This vulnerability allows attackers to inject payloads that execute arbitrary web scripts and HTML, exploiting a storage-based XSS flaw.

Impact

Exploitation of this vulnerability allows for storage-based cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into O2OA version 9.1.3 and navigate to the Meetings - Settings section. Inject a payload into the settings and save it. After refreshing the page, the injected script will execute when the Settings button is clicked again.

Remediation

A small version fix is planned for release.