CVE-2025-3388
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts through the username parameter during login in the hailey888 oa_system. When exploited, it enables cross-site scripting attacks that can steal user sessions or redirect users to malicious sites. All users of oa_system versions up to 2025.01.01 are affected.
💻 Affected Systems
- hailey888 oa_system
📦 What is this software?
Oa System by Hailey888
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full system access, and compromise all organizational data.
Likely Case
Attackers steal user session cookies to impersonate legitimate users and access sensitive information.
If Mitigated
Scripts execute but are contained within the user's browser session without accessing backend systems.
🎯 Exploit Status
Exploit details have been publicly disclosed on Gitee and vuldb.com, making weaponization likely. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/hailey888/oa_system/issues/IBRQYI
Restart Required: Yes
Instructions:
1. Monitor the Gitee repository for updates. 2. Apply any patches to the LoginsController.java file. 3. Restart the application server. 4. Validate that username input is properly sanitized.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side input validation to sanitize username parameters before processing.
Add input sanitization in loginCheck function: String sanitizedUsername = username.replaceAll("<[^>]*>", "");
WAF Rule
allDeploy web application firewall rules to block XSS payloads in username parameters.
ModSecurity rule: SecRule ARGS:username "@detectXSS" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution.
- Deploy a reverse proxy with XSS filtering for all login requests.
🔍 How to Verify
Check if Vulnerable:
Test by entering <script>alert('XSS')</script> as username during login and check if script executes.Check Version:
Check application version in deployment configuration or contact system administrator.Verify Fix Applied:
Attempt the same XSS payload and verify it's either blocked or properly sanitized without execution.📡 Detection & Monitoring
Log Indicators:
- Unusual username patterns containing script tags or JavaScript code in login attempts
- Multiple failed login attempts with suspicious usernames
Network Indicators:
- HTTP requests with script tags in username parameters
- Unusual traffic patterns to login endpoints
SIEM Query:
source="web_logs" AND (username="*<script>*" OR username="*javascript:*")