Description

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reachable without authentication when the AD_Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset and idTag values returned by AD_Server::getVMAPSFromRequest() directly into VMAP attributes without encoding. Those values originate from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter, which is not covered by $securityFilter in objects/security.php. A remote attacker can craft a vmaps value (containing a non-empty VAST.campaing entry) and induce a user to open the resulting VMAP URL or a video page using it, injecting arbitrary <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated XML. The player's IMA path (afterVideoJS -> PlayerSkins::setIMAADTag) then requests the attacker-supplied ad URLs, resulting in ad injection and cross-origin requests from the victim's playback session. The issue was unfixed at the time of reporting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-11T12:16:54.573Z",
  "pubdate": "2026-09-11T12:16:54.573Z",
  "executiveSummary": "WWBN AVideo (commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier) is susceptible to an XML injection vulnerability residing in the AD_Server plugin.\nThe vulnerability occurs within plugin/AD_Server/VMAP.php, allowing unauthenticated remote attackers to inject arbitrary XML elements into VMAP responses generated by the application.\nBy manipulating the base64-encoded JSON payload within the 'vmaps' request parameter, an attacker can influence the structure of the XML response sent to a victim's client.\nThe primary impact includes ad injection and potential cross-origin requests performed from the context of the victim's playback session.\nThis vulnerability is particularly critical as it does not require authentication and bypasses standard security filters defined in objects/security.php.\nSuccessful exploitation allows attackers to manipulate VAST ad tags delivered to the player, which may be leveraged for malicious advertising redirects, tracking, or sophisticated client-side attacks through the IMA path.\nThe flaw stems from a lack of input sanitization and proper encoding when embedding user-controlled data into XML attributes.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of user-supplied data in the plugin/AD_Server/VMAP.php file within the WWBN AVideo framework. Specifically, the script extracts 'timeOffset' and 'idTag' values derived from the $_REQUEST['vmaps'] parameter without applying necessary output encoding or validation. These values are processed via AD_Server::getVMAPSFromRequest(), which performs base64 decoding and JSON parsing on the input string.\nBecause the 'vmaps' parameter bypasses the $securityFilter implemented in objects/security.php, the application fails to mitigate malicious input before incorporating it into the final XML structure. When the script emits an 'application/xml' Content-Type header, it directly inserts these decoded values into VMAP attributes. An attacker can craft a payload containing a non-empty VAST.campaing entry, enabling the injection of arbitrary <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated document.\nThe exploitation flow begins when an unauthenticated attacker constructs a malicious base64-encoded JSON object designed to inject specific XML nodes. The attacker then induces a target user to interact with a URL that leverages this payload. The victim's browser or media player processes the resulting VMAP document, which is interpreted as legitimate configuration for the video playback.\nOnce the injected XML is parsed, the player's IMA (Interactive Media Ads) path—specifically triggered through PlayerSkins::setIMAADTag—attempts to resolve the attacker-supplied ad URLs. This mechanism forces the client to perform cross-origin requests to third-party domains. By controlling these ad tags, an attacker can achieve ad injection or redirect the user to arbitrary remote resources. The vulnerability is reachable without authentication, requiring only the AD_Server plugin to be active on the target installation. The persistent lack of sanitization ensures that any crafted input is reflected in the XML response, facilitating remote exploitation of users via the application's media playback functionality."
}