Yonyou UFIDA ERP-NC Cross-Site Scripting Vulnerability in menu.jsp

A reflected cross-site scripting vulnerability has been identified in Yonyou UFIDA ERP-NC version 5.0. This issue arises in the menu.jsp file, where the 'flag' parameter is not properly sanitized before being outputted, allowing for the injection of malicious JavaScript. The vulnerability can be exploited remotely, without authentication, but requires user interaction.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the menu.jsp page with a crafted 'flag' parameter that includes JavaScript code, such as a script tag with an alert command. The injected script will be executed in the context of the victim's browser.