Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-11T12:16:55.533Z",
  "pubdate": "2026-09-11T12:16:55.533Z",
  "executiveSummary": "WWBN AVideo, up to commit c3edcc274c389816d434acadac07ee78eaf330c1, is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability within the 'donationLink' profile field.\nThe vulnerability arises from insufficient input validation and output encoding when processing user-provided URLs.\nAn authenticated attacker can inject malicious JavaScript payloads into their profile, which are subsequently rendered in the context of other users' sessions, including administrative sessions.\nThis flaw allows for the execution of arbitrary JavaScript, potentially leading to session hijacking, unauthorized actions, or information theft.\nThe vulnerability is triggered when a victim interacts with the donation button on a video watch page, making it a persistent threat to any user viewing an attacker's content.\nExploitation requires an authenticated user account to update their profile and subsequent interaction by a victim with the malicious UI element.",
  "technicalDetails": "The root cause of this vulnerability is improper sanitization and insecure output handling within the user profile management system. Specifically, the User::setDonationLink() method in objects/user.php relies solely on filter_var() with the FILTER_VALIDATE_URL flag to validate user input. This filter is insufficient for preventing XSS, as it permits strings containing URL-encoded characters or quotes that can be used to break out of HTML attributes.\nDuring the retrieval process, the getDonationLink() function applies only strip_tags(). This is ineffective because it does not encode double quotes, which are crucial for breaking out of an HTML tag's attribute context. The plugin/CustomizeUser/actionButton.php file then takes this unsanitized string and injects it directly into an <a href> tag attribute without performing necessary context-aware output encoding.\nThe attack flow proceeds as follows: An authenticated user accesses objects/userUpdate.json.php to update their 'donationLink' profile field with a malicious payload, such as 'http://evil.example/\"onmouseover=alert(document.domain)//'. Because the backend validation accepts this string, it is stored in the database.\nWhen a visitor—potentially an administrator—navigates to a video watch page where the CustomizeUser option 'allowDonationLink' is enabled, the view/modeYoutubeBottom.php file includes the malicious button. The browser renders the donation link with the injected JavaScript payload. When the victim interacts with this button (e.g., hovering over it), the browser executes the attacker-supplied JavaScript code.\nThis stored XSS attack is highly effective because it persists for the lifetime of the profile update, requiring no further action from the attacker once the payload is stored. The impact includes the ability to perform actions on behalf of the victim, exfiltrate sensitive cookies, or redirect users to malicious domains, significantly compromising the integrity and security of the AVideo platform."
}