Yonyou UFIDA ERP-NC Cross-Site Scripting Vulnerability in Help System Pages
Vulnerability
A reflected cross-site scripting vulnerability has been identified in Yonyou UFIDA ERP-NC version 5.0. The issue arises in the '/help/systop.jsp' and '/help/top.jsp' files, where the 'langcode' parameter is not properly sanitized before being outputted. This flaw allows remote attackers to inject malicious JavaScript that is executed in the context of the user's browser.
Impact
Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed immediately in the context of the victim's browser.
Reproduction
To reproduce this vulnerability, send a request to either '/help/systop.jsp' or '/help/top.jsp' with a crafted 'langcode' parameter that includes JavaScript payloads, such as SVG images with 'onload' events. The lack of proper input sanitization will result in the execution of the injected script.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.