CVE-2025-10272
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts via the Name parameter in erjinzhi 10OA 1.0's catalogue functionality, leading to cross-site scripting attacks. It affects users of erjinzhi 10OA version 1.0 who access the vulnerable /trial/mvc/catalogue endpoint. The vulnerability can be exploited remotely without authentication.
💻 Affected Systems
- erjinzhi 10OA
📦 What is this software?
10oa by 10oa
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users, potentially leading to account compromise or data theft.
Likely Case
Attackers inject malicious JavaScript to steal session cookies or redirect users to phishing pages, compromising individual user accounts.
If Mitigated
With proper input validation and output encoding, the malicious scripts would be rendered harmless as text rather than executable code.
🎯 Exploit Status
The exploit has been publicly disclosed and may be utilized. Attack can be initiated remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available as the vendor has not responded. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement server-side validation and sanitization of the Name parameter to remove or encode HTML/JavaScript characters.
Web Application Firewall (WAF) Rules
allDeploy WAF rules to block requests containing suspicious script patterns in the Name parameter.
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Disable or restrict access to the /trial/mvc/catalogue endpoint if not required
🔍 How to Verify
Check if Vulnerable:
Test by submitting a payload like <script>alert('XSS')</script> in the Name parameter to /trial/mvc/catalogue and check if it executes in the browser.Check Version:
Check the software version in the application interface or configuration files; specific command unknown.Verify Fix Applied:
After implementing fixes, retest with the same payload to ensure it's properly sanitized or blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /trial/mvc/catalogue with script-like content in parameters
- Multiple failed attempts with malicious payloads
Network Indicators:
- HTTP requests containing <script> tags or JavaScript in the Name parameter
SIEM Query:
source="web_logs" AND uri="/trial/mvc/catalogue" AND (param="Name" AND value MATCHES "<script>|javascript:")