PT-2025-15311 · Unknown · Hailey888 Oa System

Hailey · Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-3391

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: hailey888 oa system versions up to 2025.01.01

Description: A vulnerability has been found in the function outAddress of the file cn/gson/oass/controller/address/AddrController.java of the component Backend. The manipulation of the argument outtype leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continuous delivery. Therefore, version details for affected and updated releases are not available.

Recommendations: As a temporary workaround, consider restricting access to the outAddress function of the AddrController class until a patch is available. Avoid using the outtype argument in the affected Backend component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-3391

Affected Products

Hailey888 Oa System

References · 10

• 🔥 https://gitee.com/hailey888/oa_system/issues/IBRRX3 · Exploit
• https://osv.dev/vulnerability/CVE-2025-3391 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3391 · Security Note
• https://t.me/cvenotify/118136 · Telegram Post
• https://vuldb.com/?id.303637 · Note
• https://twitter.com/CVEnew/status/1909436582291292344 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1909469073785618459 · Twitter Post
• https://vuldb.com/?ctiid.303637 · Note
• https://t.me/cvedetector/22383 · Telegram Post
• https://t.me/cvetracker/21056 · Telegram Post