Seeyon Zhiyuan A8+ Collaborative Management Software Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in Seeyon Zhiyuan A8+ Collaborative Management Software version 7.0. The issue arises in the main.do endpoint, where the topValue parameter can be manipulated to inject malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the seeyon/main.do endpoint with a crafted topValue parameter that includes the desired script payload. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.