Dianping CAT Open Redirect and XSS Vulnerabilities

Open redirect in Dianping CAT 3.0.0, 3.1.0, and 4.0-RC1 lets unauthenticated remote attackers control the rtnUrl argument of Handler.redirect in the Login/Logout component and send a victim to an attacker-chosen destination after passive user interaction (CVSS 5.3). The impact is limited to low integrity - phishing and trust abuse - with no confidentiality or availability loss and no server-side code execution. The advisory states an exploit has been published and may be used; no CISA KEV entry appears in the supplied data.

Reflected cross-site scripting in Dianping CAT 3.0.0, 3.1.0, and 4.0-RC1 allows unauthenticated remote attackers to supply a crafted 'domain' argument that Model.getDomain reflects unsanitized into the WEB-INF/tags/hourlyReport.tag Report Handler view, executing script in the browser of a CAT user who opens the link. The CVSS 4.0 base score is 5.3, the independent CVSS 3.1 assessment is 5.3, and the issue is rated medium severity with a this_month priority; exploitation requires user interaction and is confined to the victim's dashboard session. A public exploit disclosure exists, but it is not verified as working exploit code, and no CISA KEV confirmation is provided.