liuwy-dlsdys zhglxt HTTP POST Request edit cross site scripting

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in liuwy-dlsdys zhglxt version 4.7.7. The issue affects the /oa/notify/edit endpoint, where the HTTP POST request handler processes the notifyTitle parameter without proper sanitization. The software fails to encode or validate user-controlled input before storing it, allowing injection of arbitrary HTML and JavaScript [1].

Exploitation

An attacker must first authenticate to the zhglxt application with administrative privileges (default credentials system/system are commonly used) [1]. After login, the attacker navigates to the announcement management menu and clicks the add button. In the notifyTitle field of the POST request to /zhglxt/oa/notify/edit, the attacker inserts a payload such as ``. Upon saving, the payload is stored in the system. The injected script executes in the browser of any user who subsequently uses the search functionality [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session cookie theft, sensitive information disclosure, or further actions limited to the scope of a stored XSS attack. The attack requires administrative login, but any user triggering the search action is affected [1].

Mitigation

As of the publication date (2024-01-19), no official patch or fixed version has been released. Users should sanitize the notifyTitle input by escaping HTML entities on both input and output. Upgrading the application to a future patched version is advised once available [1].