java-aodeng Hope-Boot Cross-Site Scripting Vulnerability in WebController

A cross-site scripting (XSS) vulnerability has been identified in java-aodeng Hope-Boot version 1.0.0. The issue arises in the WebController.java file, specifically within the login function. The vulnerability is triggered by manipulating the errorMsg argument, which allows for the injection of malicious scripts. This issue can be exploited remotely and requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the '/login' endpoint with a crafted errorMsg parameter that includes JavaScript code. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.