Description

AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-26T14:16:44.260Z",
  "pubdate": "2026-09-26T14:16:44.260Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified within the AVideo platform. The issue resides in the processing of the 'video trailer1' field, which fails to adequately sanitize user-supplied input before rendering it within an inline onclick JavaScript event handler.\nThe vulnerability allows an authenticated attacker possessing video upload privileges to inject malicious payloads. Because the application utilizes HTML entity-encoded strings, the browser decodes these values at runtime, enabling an attacker to escape the JavaScript context and execute arbitrary client-side code.\nThe impact is significant, as successful exploitation results in the execution of malicious scripts within the browser session of any user viewing the affected video, including those with administrative privileges. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or the exfiltration of sensitive information.\nThe risk profile is high due to the potential for full account takeover of administrative users. Exploitation requires the attacker to have at least minimal upload permissions, effectively limiting the scope to authenticated users, yet posing a severe threat to the integrity and confidentiality of the AVideo environment.",
  "technicalDetails": "The vulnerability stems from improper input validation and output encoding in the AVideo video trailer handling module. Specifically, the 'video trailer1' field is rendered directly into an inline 'onclick' JavaScript event handler within the HTML document. While the application attempts to validate this input via the 'isValidURL()' function, the validation logic is insufficient to prevent the injection of malicious characters.\nAttackers can bypass 'isValidURL()' by crafting payloads that utilize HTML entity encoding. Since the browser decodes these entities before the JavaScript interpreter processes the 'onclick' event string, the payload can effectively terminate the intended JavaScript string literal and initiate a new command sequence.\nThe attack flow proceeds as follows: First, an authenticated attacker with permissions to upload or edit video metadata submits a crafted string containing an XSS payload into the 'video trailer1' field. The server stores this payload in the database without sufficient sanitization. When a victim—which could be an administrator—navigates to the video page, the server renders the malicious content directly into the HTML source code within the 'onclick' attribute.\nOnce the page loads, the victim's browser interprets the 'onclick' attribute. The browser's HTML parser decodes the entity-encoded payload, allowing the attacker-injected code to break out of the JavaScript string context. The browser then executes the arbitrary JavaScript in the security context of the victim's session.\nBecause this is a stored XSS vulnerability, the payload remains persistent on the server. The malicious script is executed every time the compromised video page is loaded. The post-exploitation impact includes the ability to perform actions within the AVideo interface using the victim's cookies and session tokens, redirection to malicious domains, or harvesting credentials through DOM manipulation. This is particularly critical when an administrator views the video, as the script gains access to administrative functions and elevated privileges, facilitating further compromise of the platform."
}