JeeWMS Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in JeeWMS versions through 3.7. The issue arises in the logController.do component, where the reportType parameter is not properly sanitized. This flaw allows remote attackers to inject malicious scripts, potentially leading to the exposure of sensitive information.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the logController.do interface with the reportType parameter containing a script tag, such as one including JavaScript code to trigger an alert. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.