Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the AD_Server plugin's log.php endpoint that fails to escape the label parameter before storage. An unauthenticated attacker can inject malicious HTML through the label parameter, which is later rendered unsanitized in the admin Ad Types report using jQuery .html(), allowing execution of arbitrary JavaScript in an administrator's browser session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-09-10T14:17:14.637Z",
  "pubdate": "2026-09-10T14:17:14.637Z",
  "executiveSummary": "This vulnerability is a stored cross-site scripting (XSS) flaw identified in the AD_Server plugin of the AVideo platform, affecting commits up to c3edcc274c389816d434acadac07ee78eaf330c1.\nThe issue stems from the improper sanitization of user-supplied input within the log.php endpoint, specifically targeting the label parameter.\nBy injecting malicious HTML or JavaScript payloads into this parameter, an unauthenticated attacker can persist arbitrary code within the application database.\nWhen an administrator accesses the Ad Types report in the application backend, the injected payload is rendered unsanitized via jQuery .html(), leading to unauthorized script execution within the context of the administrator's browser session.\nSuccessful exploitation allows for the potential hijacking of administrative sessions, theft of sensitive session cookies, or unauthorized actions performed on behalf of the administrator.\nThe vulnerability represents a significant risk to the integrity and confidentiality of the AVideo administration dashboard and requires immediate attention through input validation and output encoding.",
  "technicalDetails": "The vulnerability resides within the AD_Server plugin, specifically in the log.php endpoint, which serves as a sink for incoming advertisement tracking data.\nThe root cause is a failure to implement robust input validation or output encoding on the label parameter during the data submission process.\nBecause the input is stored directly into the backend database without sanitization, the application treats the malicious string as trusted content.\nThe exploitation flow begins when an unauthenticated attacker sends a crafted HTTP request to log.php, injecting a payload containing script tags or malicious HTML into the label parameter.\nOnce the payload is successfully stored, it persists within the system's log entries associated with Ad Types.\nThe vulnerability is triggered when an administrative user navigates to the Ad Types report interface. The client-side application fetches the stored, malicious label content and injects it directly into the Document Object Model (DOM) using the jQuery .html() function.\nThe use of .html() is particularly dangerous in this context because it parses the string as HTML, thereby executing any included JavaScript fragments immediately upon rendering.\nThe execution occurs within the security context of the administrator’s browser, granting the attacker the ability to interact with the DOM, access cookies, steal session tokens, or force the administrator's browser to execute requests against the AVideo API.\nAs this process does not require authentication to inject the payload, it is accessible to any remote attacker with network access to the target instance.\nPost-exploitation impact includes full account takeover of administrative accounts, defacement of the management console, or the redirection of administrative traffic to external malicious domains."
}