Affected Version<\/strong>: 11.9.1.3-1857
Vulnerability Type<\/strong>: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (CWE-79)
Security Risk<\/strong>: High
Vendor<\/strong>: Agorum
Vendor URL<\/strong>: https:\/\/www.agorum.com\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: Requested
CVE Link<\/strong>: Requested
Advisory ID<\/strong>: usd-2025-0026<\/p>\n
Description<\/h3>\n
agorum core is an open-source Enterprise Content Management (ECM) system developed by agorum Software GmbH in Germany. It offers a modular, highly customizable platform for document management, workflow automation, and digital collaboration.<\/p>\n
Proof of Concept<\/h3>\n
agorum core is affected by numerous reflected cross-site scripting (XSS) vulnerabilities across a wide range of parameters, indicating a lack of proper input sanitization and output encoding. These flaws can be exploited by attackers to inject malicious scripts, potentially compromising user sessions, stealing credentials, or defacing content. The widespread nature of the vulnerabilities suggests systemic issues in the application's input handling architecture.<\/p>\n
The following request can be crafted and sent to a victim. When opened, it executes JavaScript within the context of the victim\u2019s browser session:<\/p>\n
<\/span>GET<\/span> \/roiwebui\/roiwebui_module\/BeginSSOLogin.jsp?userName=%22);}alert(document.domain);%3C\/script%3E<\/span> HTTP<\/span>\/<\/span>1.1
<\/span>Host<\/span>:<\/span> localhost
<\/span>[...]<\/span><\/pre>\n<\/div>\nIn the server's response, the user-supplied JavaScript is reflected and executed, resulting in an alert dialog, as demonstrated in the screenshot below:<\/p>\n
![\"\"](\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/06\/xss.png\")
<\/p>\n
As previously mentioned, the payload above is provided as an example. There are numerous other endpoints that exhibit the same vulnerability. A non-exhaustive list includes:<\/p>\n
\n- OpenDocumentMessage.jsp<\/li>\n
- ShowSSOMessageBox.jsp<\/li>\n
- SSO.jsp<\/li>\n
- SSOConvertToPdf.jsp<\/li>\n
- SSOFileListStart.jsp<\/li>\n
- SSOPageStart.jsp<\/li>\n
- SSOKeepAlive.jsp<\/li>\n
- SSOPortal.jsp<\/li>\n
- SSOPortalWindow.jsp<\/li>\n
- SSOPortalTabFrameSet.jsp<\/li>\n
- SSOSearchMask.jsp<\/li>\n
- SSOSearchMaskStart.jsp<\/li>\n
- ReExtendedSearch.jsp<\/li>\n
- ClientNewWindowsLoader.jsp<\/li>\n
- RSSReader.jsp<\/li>\n
- ReportingFrameSet.jsp<\/li>\n<\/ul>\n
Fix<\/h3>\n
It is strongly recommended to implement robust input validation and output encoding across all user-supplied parameters. Adopt a security-focused development framework or library that provides built-in protections against XSS, and ensure that all dynamic content rendered in the browser is properly escaped based on context (e.g., HTML, JavaScript, URL).<\/p>\n
<\/p>\n
Users of agorum core open can upgrade to versions 11.9.2 and 11.10.1.<\/p>\n
References<\/h3>\n
<\/p>\n