baseweb JSite Cross-Site Scripting Vulnerability in User Management Interface

A cross-site scripting (XSS) vulnerability has been identified in baseweb JSite version 1.0. The issue arises in the '/a/sys/user/save' file, where the 'name' parameter can be manipulated to inject malicious JavaScript. This vulnerability can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Institutional Users' section, then 'User Management', and select 'Add New User'. In the 'Username' field, enter a script tag payload, such as a JavaScript alert. This payload will be executed when the saved user information is viewed.