thinkgem JeeSite Cross-Site Scripting Vulnerability in EncodeUtils.java

A cross-site scripting (XSS) vulnerability has been identified in thinkgem JeeSite versions prior to 5.12.1. The issue resides in the 'decodeUrl2' function of 'EncodeUtils.java', where improper input sanitization allows for the injection of malicious scripts. This vulnerability can be exploited remotely, requiring user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, upload a payload that includes an XSS vector, such as an 'embed' tag with a 'data' URL, to a field that is processed by the 'decodeUrl2' function. The injected script will be executed when the data is viewed.

Remediation

Users are advised to upgrade to JeeSite version 5.13.0, which addresses this vulnerability.