Executive brief
The fuint Member Marketing System, a platform used for managing customer loyalty and marketing campaigns, contains a security flaw in its messaging component. An attacker can send a specially crafted link to a user; if clicked, the attacker can execute malicious scripts in the user's browser. This could lead to the theft of login session cookies, unauthorized access to user accounts, or the display of fraudulent content to customers.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the `wxPush` method within `ClientMessageController.java`. The application fails to sanitize or encode the `echostr` URL parameter before reflecting it directly into the HTTP response. A remote, unauthenticated attacker can exploit this by tricking a user into clicking a malicious URL, allowing the execution of arbitrary JavaScript in the context of the user's session. This can be used to exfiltrate session tokens or perform actions on behalf of the user. The vulnerability is confirmed in version 1.0 and earlier.
Affected products
- fuint Member Marketing System <=v1.0
Timeline
- 2026-04-12: disclosed: Vulnerability reported on GitHub issues
- 2026-07-20: advisory: CVE published to NVD