Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an <img src="..."> attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T12:16:53.493Z",
  "pubdate": "2026-09-11T12:16:53.493Z",
  "executiveSummary": "WWBN AVideo, up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability located within the 'plugin/Live/confirmLivePassword.php' component.\nThis vulnerability stems from the insecure handling of the unauthenticated 'u' GET parameter, which is processed without proper sanitization or encoding before being reflected in the HTML source.\nA remote, unauthenticated attacker can exploit this flaw by crafting a malicious URL containing a payload that breaks out of an image tag's attribute context. When a target user, such as an administrator, navigates to this link, the injected JavaScript executes within the context of their session.\nSuccessful exploitation allows for arbitrary code execution in the victim's browser, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or exfiltration of sensitive information.\nGiven that this vulnerability requires no authentication and targets the application's origin, it poses a significant risk to the integrity and confidentiality of the AVideo platform's users.",
  "technicalDetails": "The root cause of this vulnerability is the failure to perform input validation and output encoding on the 'u' GET parameter within the 'plugin/Live/confirmLivePassword.php' file. The application directly interpolates the raw input from the 'u' parameter into the 'src' attribute of an HTML '<img>' element without applying sufficient security filters. Specifically, this parameter is explicitly excluded from the application's '$securityFilter' mechanisms, leaving it vulnerable to injection attacks.\nThe exploitation process involves an attacker manipulating the 'u' parameter to break out of the HTML attribute context. By injecting a double-quote character (\"), the attacker terminates the 'src' attribute prematurely. Following this, the attacker can inject additional HTML attributes, most notably the 'onerror' event handler. Because the browser attempts to load the image from an invalid or malformed URL, the 'onerror' event triggers immediately, resulting in the execution of arbitrary JavaScript.\nThe full exploit vector requires the attacker to include a non-empty 'key' parameter while ensuring that the 'c' parameter remains absent or invalid. This specific combination allows the request to reach the vulnerable code path in 'confirmLivePassword.php'.\nThe attack flow is as follows: 1) The attacker constructs a malicious URL targeting the specific script and includes the payload within the 'u' parameter. 2) The attacker baits an authenticated user (such as an administrator) to click the link or browse to it via a hidden iframe. 3) The server reflects the malicious payload back into the HTML response. 4) The victim's browser renders the page, attempts to process the malformed '<img>' tag, triggers the 'onerror' event, and executes the embedded JavaScript payload in the victim's session.\nSince the injected script executes within the origin of the AVideo instance, it inherits the permissions associated with the victim's session. This allows for the compromise of administrative functionality, potentially leading to a full system compromise if an administrator falls victim to the attack. The lack of validation on the 'u' parameter ensures that this remains a persistent reflected XSS threat across the affected versions until proper encoding is implemented."
}