github.comexploitissue tracking
https://github.com/Hebing123/cve/issues/86 CVE-2025-2711
MEDIUMNuclei
Yonyou UFIDA ERP-NC systop.jsp cross site scripting
Record summary
CVE-2025-2711 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been classified as problematic. Affected is an unknown function of the file /help/systop.jsp. The manipulation of the argument langcode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 25, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
UFIDA ERP-NCBrowse Yonyou / UFIDA ERP-NC | CVE List | 5.0 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMYonyou UFIDA ERP-NC V5.0 - Cross-Site ScriptingCVSS 6.1
Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting (XSS) via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution.
Impact
Successful exploitation of this XSS vulnerability allows attackers to execute arbitrary JavaScript code in victims' browsers, potentially leading to session hijacking, credential theft, or other malicious activities in the ERP system.
Remediation
Update Yonyou UFIDA ERP-NC to the latest version. Implement proper input validation and output encoding for all user-supplied data, especially the langcode parameter in help JSP files.
WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2025xsserp-ncufidayonyouvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:yonyou:ufida_erp-nc:5.0:*:*:*:*:*:*:*
Shodan: title:"用友"
FOFA: icon_hash="1085941792"
Source: ProjectDiscovery
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-2711 VDB-300732 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.300732 VDB-300732 | Yonyou UFIDA ERP-NC systop.jsp cross site scriptingvdb entryTechnical description
https://vuldb.com/?id.300732 Submit #517309 | Yonyou UFIDA ERP-NC V5.0 Cross Site ScriptingThird-party advisory
https://vuldb.com/?submit.517309