CVE-2025-2712: Yonyou Ufida ERP-NC XSS Vulnerability

CVE-2025-2712 Overview

CVE-2025-2712 is a reflected cross-site scripting (XSS) vulnerability in Yonyou UFIDA ERP-NC 5.0. The flaw resides in the /help/top.jsp endpoint, where the langcode parameter is rendered without proper sanitization. An unauthenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session when clicked. The vulnerability is tracked as [CWE-79] and has been publicly disclosed. According to the reporter, the vendor was contacted about this issue but did not respond.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in an authenticated user's browser context, enabling session theft, phishing, and unauthorized actions within the ERP application.

Affected Products

Yonyou UFIDA ERP-NC 5.0
Affected component: /help/top.jsp
Affected parameter: langcode

Discovery Timeline

2025-03-24 - CVE-2025-2712 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2712

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw affecting the help subsystem of Yonyou UFIDA ERP-NC 5.0. The /help/top.jsp page accepts a langcode query parameter that determines the language content to display. The application echoes the value of langcode back into the HTTP response without applying output encoding or input validation. This behavior allows an attacker to inject arbitrary HTML or JavaScript that the victim's browser will execute in the trust context of the ERP application.

Because the vulnerable endpoint is part of a business-critical Enterprise Resource Planning (ERP) system, exploitation can expose financial workflows, employee data, and administrative sessions. The attack requires user interaction, typically by convincing a logged-in user to visit a crafted link.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The JSP page writes the langcode request parameter directly into the response markup without HTML entity encoding or contextual escaping. No allowlist validation restricts the parameter to expected values such as ISO language codes.

Attack Vector

Exploitation is network-based and requires no privileges. An attacker delivers a specially crafted URL containing malicious script content in the langcode parameter to a victim, typically through phishing or a malicious referrer. When the authenticated user loads the URL, the injected script executes with access to the user's session cookies, Document Object Model (DOM), and any ERP functionality accessible to that user.

A representative attack pattern involves appending a script payload to the langcode parameter of /help/top.jsp. Public proof-of-concept discussion is available on the GitHub CVE issue tracker and in the VulDB entry #300733.

Detection Methods for CVE-2025-2712

Indicators of Compromise

HTTP requests to /help/top.jsp containing <script>, javascript:, onerror=, or URL-encoded equivalents in the langcode parameter.
Access logs showing unusual langcode values exceeding expected short ISO-style codes.
Referer headers pointing to external or untrusted domains preceding requests to the help endpoint.

Detection Strategies

Deploy web application firewall (WAF) rules to inspect the langcode parameter for script tags, event handlers, and encoded payloads.
Enable server-side request logging on the JSP help module and alert on non-alphanumeric characters in the langcode field.
Correlate suspicious /help/top.jsp requests with subsequent session activity from the same user to identify possible session compromise.

Monitoring Recommendations

Aggregate ERP application logs into a centralized platform and baseline normal langcode values.
Monitor for authenticated user sessions initiating unusual privileged actions shortly after visiting /help/top.jsp.
Track outbound network connections from browsers accessing the ERP portal for beaconing consistent with stolen session exfiltration.

How to Mitigate CVE-2025-2712

Immediate Actions Required

Restrict access to /help/top.jsp at the network or reverse-proxy layer until a fix is available.
Deploy WAF signatures that block script injection patterns in the langcode parameter.
Notify ERP users of the phishing risk and reinforce caution when opening links referencing the ERP portal.

Patch Information

No vendor patch has been published at the time of writing. The reporter indicates the vendor did not respond to disclosure attempts. Organizations should monitor the GitHub issue discussion and VulDB advisory for updates and contact Yonyou support directly to request a fix.

Workarounds

Configure a reverse proxy to enforce strict validation of the langcode parameter, allowing only expected values such as zh_CN or en_US.
Set the HttpOnly and Secure flags on ERP session cookies to limit script access to authentication tokens.
Implement a Content Security Policy (CSP) header restricting inline scripts and untrusted origins on ERP pages.
Disable the help subsystem if it is not required for business operations.

bash

# Example nginx reverse proxy rule to block suspicious langcode values
location /help/top.jsp {
    if ($arg_langcode !~* "^[a-z]{2}_[A-Z]{2}$") {
        return 403;
    }
    proxy_pass http://erp-backend;
}