hailey888 oa_system Backend Cross-Site Scripting Vulnerability in DaymanageController

A cross-site scripting (XSS) vulnerability has been identified in hailey888 oa_system versions prior to 2025.01.01. The issue resides in the Backend component, specifically within the addandchangeday function of the DaymanageController.java file. The vulnerability arises from improper handling of the scheduleList argument, which can be manipulated to inject malicious scripts. This issue can be exploited remotely.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.