YouDianCMS Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in YouDianCMS version 9.5.21. The issue arises in the file '/App/Tpl/Member/Default/Order/index.html', where the 'OrderNumber' parameter is not properly sanitized before being returned to the user's browser. This flaw allows attackers to inject malicious JavaScript into the URL, which is then executed in the context of the user's session.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, log into the YouDianCMS application and navigate to the order index page. Once there, append a crafted 'OrderNumber' parameter to the URL that includes JavaScript payloads, such as an alert script. The injected script will be executed in the browser, demonstrating the cross-site scripting vulnerability.