Remote code execution via reflection blacklist bypass

Code injection in O2OA 9.0.3 allows remote authenticated users to execute operating-system commands through a scripted process. The mainOutput script relies on a hard-coded blocked-class list that Java reflection bypasses to invoke Runtime.exec with attacker-supplied code. Exploitation requires an administrator to save the malicious Script Activity and a normal user to launch the process, after which commands run on the O2OA server.