yangzongzhuan RuoYi edit cross site scripting

Successful exploitation of CVE-2025-8847 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can lead to a variety of malicious outcomes, including stealing session cookies, redirecting users to phishing sites, or modifying the content displayed on the RuoYi application. Given the nature of XSS, the impact can range from minor annoyance to complete compromise of user accounts and data. The vulnerability's remote accessibility significantly broadens the attack surface, making it a potential target for widespread exploitation.

Organizations utilizing RuoYi for content management or internal applications are at risk. Specifically, deployments with weak input validation or inadequate security configurations are particularly vulnerable. Shared hosting environments running RuoYi are also at increased risk, as a compromise of one tenant could potentially impact others.

• php: Examine RuoYi application logs for suspicious requests to /system/notice/edit with unusual or encoded values in the noticeTitle or noticeContent parameters. Use grep to search for patterns indicative of XSS payloads within these requests.

grep -i 'javascript:|onerror=|onload=' /var/log/apache2/access.log | grep '/system/notice/edit'

• generic web: Monitor response headers for unexpected content or redirects following requests to /system/notice/edit. Use curl to test the endpoint with various input values and observe the response.

curl -X POST -d "noticeTitle=<script>alert('XSS')</script>" http://your-ruoyi-instance/system/notice/edit

1. 2025-08-11Disclosure

   disclosure

1. Reservado2025-08-10
2. Publicada2025-08-11
3. Modificada2025-08-12
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-8847 is to upgrade RuoYi to version 4.8.2 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on the noticeTitle and noticeContent parameters within the /system/notice/edit endpoint. Web application firewalls (WAFs) can also be configured to detect and block XSS attempts targeting this specific endpoint. Regularly review and update RuoYi's security configuration to minimize the risk of similar vulnerabilities.