Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST_URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of the action attribute and inject event handlers that execute in the victim's browser within the site origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T12:16:53.650Z",
  "pubdate": "2026-09-11T12:16:53.650Z",
  "executiveSummary": "WWBN AVideo is affected by a reflected cross-site scripting (XSS) vulnerability located in the confirmLivePassword.php file.\nThe vulnerability stems from the improper handling of user-supplied input contained within the REQUEST_URI, which is subsequently reflected into a form action attribute without adequate output encoding.\nAn attacker can exploit this flaw by crafting a malicious URL containing specific quote characters to escape the HTML attribute context.\nSuccessful exploitation allows for the execution of arbitrary JavaScript within the context of the victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the user.\nThis vulnerability affects all AVideo versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe risk is categorized as high, as it requires only the user to interact with a crafted link, bypassing origin-based security policies through direct injection into the document object model.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of server-side script output where the environment variable REQUEST_URI is directly embedded into the HTML form action attribute within the confirmLivePassword.php file. In standard web server configurations, REQUEST_URI includes the path and query string components of the current request. Because the application fails to perform context-aware output encoding or sanitization, characters such as the double-quote (\") are rendered verbatim into the HTML structure.\nThe exploitation flow begins when an attacker identifies that the confirmLivePassword.php script reflects the request path into the action attribute of a <form> element. By crafting a URL with a malicious payload appended to the URI—such as '\" onmouseover=\"alert(document.domain)\" '—the attacker effectively breaks out of the intended action attribute context. The resulting rendered HTML transforms the legitimate form tag into one containing an arbitrary event handler. For instance, the injected attribute allows the browser to execute the attacker's script immediately when the user interacts with the form or element.\nBecause the payload is reflected in the victim's browser, the script executes within the security origin of the WWBN AVideo installation. This enables the attacker to access sensitive information such as document cookies (if HttpOnly is not enforced), perform actions via the browser session, or exfiltrate data to an external, attacker-controlled server. The vulnerability is categorized as reflected XSS because the payload is not persistently stored on the server but is served back to the user via the malicious link request.\nThe vulnerability is present in all versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1. It requires no specific authentication or elevated privileges to trigger, as the page is accessible to unauthorized users. Network exposure is broad, assuming the instance is reachable via standard HTTP/HTTPS protocols. Post-exploitation impact is limited only by the permissions of the victim; if an administrator interacts with the link, the attacker could theoretically perform administrative actions, escalate privileges, or modify site configurations."
}