Description

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-01T23:17:21.810Z",
  "pubdate": "2026-09-01T23:17:21.810Z",
  "executiveSummary": "This vulnerability is a Stored Cross-Site Scripting (XSS) flaw identified within the AVideo platform. The issue arises from the improper sanitization of user-supplied input handled by the Live_schedule class.\nThe vulnerability allows for the persistent injection of malicious JavaScript code into the application's database. Because this data is subsequently rendered in victim browsers without adequate encoding, it poses a significant security risk.\nThe impact includes full session hijacking, unauthorized actions performed on behalf of authenticated users, and potential defacement of the application's user interface. A notable aspect of this vulnerability is that the exploitation path through remindMe.php does not require prior authentication, significantly lowering the barrier to entry for attackers.\nWhile the primary injection point for setting titles and descriptions may require streaming permissions, the public-facing nature of the reminder mechanism exposes the application to unauthenticated actors, making this a high-risk security deficiency that could compromise the integrity and confidentiality of the AVideo platform and its user base.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Live_schedule::setTitle() and Live_schedule::setDescription() methods to perform server-side input validation or output encoding on POST parameters. By failing to sanitize these inputs, the application allows arbitrary HTML and JavaScript payloads to be stored directly in the underlying database.\nThe exploitation process follows a consistent pattern of persistent injection. An attacker with streaming privileges can invoke the affected methods to inject malicious scripts. Once stored, these payloads remain dormant until they are retrieved and rendered by the application's presentation layer.\nThe vulnerability is exacerbated by the existence of remindMe.php, an endpoint accessible without authentication. An attacker can leverage this file to trigger the execution of stored XSS payloads in the browsers of victim users who access the affected pages. When a victim navigates to a view that displays the scheduled live stream details, the browser interprets the injected payload as trusted code belonging to the AVideo origin.\nTechnically, the execution occurs because the application lacks Context-Aware Output Encoding. When the browser parses the HTML returned by the server, the injected <script> tags or event handler attributes (such as onload or onerror) are treated as executable instructions within the context of the session. This enables the attacker to manipulate the Document Object Model (DOM), intercept sensitive session tokens stored in cookies or LocalStorage, and perform arbitrary HTTP requests using the victim's authentication context.\nThe attack flow is structured as follows: First, the malicious payload is delivered via a crafted POST request to the application. Second, the payload is committed to the database storage. Third, an unauthenticated attacker triggers the display of this stored data via the remindMe.php interface. Fourth, the victim's browser executes the payload upon rendering the malicious data. Finally, the attacker captures the exfiltrated data or performs unauthorized actions via command-and-control infrastructure."
}