Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T12:16:54.117Z",
  "pubdate": "2026-09-11T12:16:54.117Z",
  "executiveSummary": "WWBN AVideo is affected by a reflected cross-site scripting (XSS) vulnerability within the Category plugin.\nThis vulnerability stems from improper neutralization of user-supplied input provided via the getBackURL parameter.\nThe affected system allows an unauthenticated attacker to inject malicious JavaScript into a dynamically generated href attribute.\nUpon a victim interacting with the Back control element, the payload executes within the context of the victim's session.\nSuccessful exploitation allows attackers to perform actions on behalf of the user, steal session cookies, capture sensitive data, or redirect users to malicious domains.\nThe risk to the platform is high, as it compromises user session integrity and browser-side security for any visitor interacting with the vulnerable UI component.",
  "technicalDetails": "The vulnerability resides in plugin/Gallery/view/Category.php within the AVideo platform. The flaw is categorized as Reflected Cross-Site Scripting (XSS) due to the application's failure to sanitize the getBackURL parameter before rendering it in the document object model (DOM).\nRoot Cause Analysis: The application logic directly echoes the value provided in the getBackURL HTTP GET parameter into the href attribute of an HTML anchor element. The input is processed without context-aware HTML entity encoding or URL validation. When SubCategorys is enabled, this specific code path is rendered to the user, creating an injection vector.\nAttack Flow: An attacker crafts a malicious URL containing a JavaScript-based payload within the getBackURL parameter (e.g., getBackURL=javascript:alert(document.cookie)). The attacker then lures an authenticated or unauthenticated user to click this link. When the victim accesses the category page, the application processes the malicious input and embeds it directly into the href attribute of the 'Back' button. Because the browser interprets the 'javascript:' URI scheme, the payload is executed immediately upon the victim clicking the button.\nExploitation Method: Since the input is reflected within an href attribute, the attacker can use the javascript: pseudo-protocol to execute arbitrary code. The lack of Content Security Policy (CSP) headers or adequate input filtering allows the payload to bypass rudimentary client-side protections. The injection does not require the attacker to bypass authentication, as the vulnerable script is exposed to the public-facing gallery view.\nAffected Versions: This vulnerability impacts WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.\nPost-Exploitation Impact: Once the script executes in the victim's browser, the attacker gains the ability to perform actions within the AVideo dashboard as the user, exfiltrate sensitive session tokens, manipulate the page content (DOM defacement), or facilitate further phishing attacks. Because the script runs in the origin of the AVideo application, it can access any data available to the user's session, effectively bypassing the same-origin policy limitations that might otherwise restrict third-party malicious site interactions."
}