CVE-2023-50609

Vulnerability

Cross-Site Scripting (XSS) vulnerability exists in AVA teaching video application service platform version 3.1. The flaw resides in the /ajax.aspx endpoint, where an attacker can inject arbitrary JavaScript via the templatedefine parameter. The vendor's website is http://www.ava.com.cn/ [1].

Exploitation

The attacker needs no prior authentication; the vulnerability is remotely exploitable. By crafting a malicious script, such as test in the templatedefine parameter, the injected script executes in the context of the victim's browser when the page is loaded [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript code in the victim's browser, leading to session hijacking, credential theft, or defacement. The impact is typically limited to the user's session and data that is accessible via the application.

Mitigation

As of the publication date, no fix has been released by the vendor. Users should apply input validation and output encoding for the templatedefine parameter, or restrict access to /ajax.aspx to trusted users only. [1]