Reflected XSS Vulnerability in Xinhu RockOA v2.6.3

[Hebing123]

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Xinhu RockOA v2.6.3, existing in the Callback parameter of /webmain/public/upload/tpl_upload.html.

Details

In /webmain/public/upload/tpl_upload.html, since the callback variable is directly concatenated into the script tag without filtering, an attacker can execute malicious JS through the callback parameter.

As shown in the figure, the attacker successfully closed the previously mentioned okla:function() and var up={} as well as the subsequently mentioned closeaa:function() through a carefully crafted input, allowing it to run normally within the script tag.

Proof of Concept (PoC)

http://your-ip/index.php?m=upload&d=public&callback=callback%20=callback;%20if%20(showid%20!=%20264569789)%20{%20alert(250);%20}%20}%20catch%20(e)%20{}%20;this.closeaa()},};alert(document.cookie);var%20test={okla:function(){if%20(showid!=10){//