Description

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/add_task.php of the component Task Title Output. Executing a manipulation of the argument og_objects.name can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T06:16:25.980Z",
  "pubdate": "2026-09-13T06:16:25.980Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in Feng Office up to version 3.11.13.11.\nThe vulnerability resides in the Task Title Output component, specifically within the getTitle function located in application/views/task/add_task.php.\nBy manipulating the og_objects.name argument, an unauthenticated or authenticated remote attacker can inject malicious scripts into the application.\nSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of the victim's session.\nThe risk includes session hijacking, unauthorized actions performed on behalf of the user, and information disclosure.\nThe vendor failed to respond to disclosures regarding this issue, leaving installations vulnerable.\nPublicly available exploit code increases the risk of successful weaponization by malicious actors.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw located within the task management module of Feng Office. The root cause is the improper handling and insufficient sanitization of user-supplied input provided through the og_objects.name parameter.\nSpecifically, the application's task creation interface processes this parameter and passes it to the getTitle function within application/views/task/add_task.php. Because this function fails to correctly encode or escape the input before rendering it in the HTML document, an attacker can submit a crafted payload containing HTML tags or JavaScript event handlers.\nThe attack flow begins when an attacker identifies the input vector associated with task creation. By intercepting the request or crafting a direct submission that includes a script-based payload (e.g., <script>alert(document.cookie)</script>) within the og_objects.name argument, the malicious content is saved directly into the application's backend database.\nOnce the payload is persisted, it is subsequently rendered in the victim's browser whenever they view the affected task details or lists. When the browser parses the response containing the malicious string, it interprets the payload as legitimate script content rather than plain text. This leads to the execution of the injected code within the origin context of the Feng Office application.\nThe exploitation process does not require specialized privileges or advanced authentication if the entry point is exposed to the public or if the attacker is an authorized user. The impact is significant, as the executed script can perform unauthorized actions via the user's session, capture sensitive session tokens, exfiltrate private data displayed on the dashboard, or perform actions that modify application data.\nBecause the input is persistently stored, every user accessing the compromised task will trigger the malicious payload, making this an effective vector for widespread account compromise within a collaborative environment. The lack of vendor-provided patches means the application currently lacks the necessary output encoding routines or Content Security Policy (CSP) headers required to mitigate this specific injection vector."
}