SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting

Successful exploitation of CVE-2025-15200 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can be leveraged to steal sensitive information such as cookies, session tokens, and personal data. An attacker could also redirect users to malicious websites or deface the application. The remote nature of the vulnerability means it can be exploited without requiring local access to the system. Given the public availability of an exploit, the risk of immediate exploitation is elevated.

Organizations utilizing SohuTV CacheCloud in their infrastructure, particularly those running versions 3.0 through 3.2.0, are at risk. Shared hosting environments where multiple users share the same CacheCloud instance are particularly vulnerable, as an attacker could potentially compromise other users' sessions.

• linux / server: Monitor access logs for suspicious requests targeting getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex with unusual parameters. Use grep to search for XSS payloads in these logs.

grep -i '<script' /var/log/apache2/access.log | grep 'getExceptionStatisticsByClient'

• generic web: Use curl to test the vulnerable endpoints with various XSS payloads and observe the response for signs of script execution.

curl -X GET 'http://<cachecloud_ip>/<vulnerable_endpoint>?param=<script>alert(1)</script>' -s

• java: Examine the application's source code for the getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex function to identify potential weaknesses in input validation or output encoding.

1. 2025-12-29Disclosure

   disclosure

2. 2025-12-29PoC

   poc

1. Reserviert2025-12-28
2. Veröffentlicht2025-12-29
3. Geändert2025-12-30
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-15200 is to upgrade SohuTV CacheCloud to version 3.2.1 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the affected functions (getExceptionStatisticsByClient/getCommandStatisticsByClient/doIndex) to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, verify the fix by attempting to inject a simple XSS payload into the vulnerable endpoints and confirming that it is properly neutralized.