Yonyou UFIDA ERP-NC menu.jsp cross site scripting

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in Yonyou UFIDA ERP-NC version 5.0. The flaw resides in the /menu.jsp page, where the flag parameter is taken from the URL and directly embedded into a JavaScript function call without any sanitization or encoding. The vulnerable code snippet shows PageId being used in opentree('<%=PageId%>','<%=topNodes%>'); [1]. This allows an attacker to inject arbitrary HTML and JavaScript.

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication. The attack involves crafting a malicious URL that includes a flag parameter containing a JavaScript payload, such as %3C/script%3E%3Cscript%3Ealert(1)%3C/script%3E. When a victim visits this URL, the injected script executes in the context of the victim's browser session [1]. No user interaction beyond clicking the link is needed.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, theft of sensitive data, defacement of the application interface, or further attacks against the victim's session. The impact is limited to the browser context and the privileges of the authenticated user if the victim is logged in.

Mitigation

As of the publication date, the vendor (Yonyou) has not responded to the disclosure and no official patch or fix has been released [1]. Users are advised to implement input validation and output encoding for the flag parameter, restrict network access to the ERP-NC application, or deploy a web application firewall (WAF) to block malicious payloads until a vendor-supplied update becomes available.