Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-11T12:16:55.690Z",
  "pubdate": "2026-09-11T12:16:55.690Z",
  "executiveSummary": "The CustomizeUser plugin within the AVideo platform is affected by a stored cross-site scripting (XSS) vulnerability, originating from improper input validation.\nThis security flaw allows an authenticated administrator to inject arbitrary malicious scripts into the application via the add.json.php endpoint.\nThe vulnerability is localized to the field_name parameter, which lacks necessary sanitization before being stored in the database.\nSuccessful exploitation occurs when a victim, typically an administrator or user, accesses affected pages such as profile forms or extra information views that invoke the typeToHTML function.\nThe execution of these scripts in the context of the user's browser session allows attackers to perform unauthorized actions on behalf of the victim, potentially leading to session hijacking, credential theft, or further administrative compromise.\nGiven the nature of the application, this flaw poses a significant risk to the integrity and confidentiality of the AVideo environment.\nThe vulnerability affects AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1.",
  "technicalDetails": "The vulnerability resides within the CustomizeUser plugin, specifically concerning the handling of the field_name parameter when processing requests through the add.json.php endpoint.\nThe root cause is the failure of the application to implement adequate input sanitization or output encoding mechanisms for user-supplied data before storing it in the persistent backend database.\nWhen an administrative user submits a request to add or modify user-customized fields, the field_name parameter is accepted by the backend as raw, untrusted input. Because the application fails to strip or neutralize HTML tags or JavaScript event handlers, malicious payloads are persisted verbatim.\nThe vulnerability manifests during the rendering phase within the client-side browser environment. When an administrator navigates to the extra info pages or profile forms, the application executes the typeToHTML function to display these user-defined fields.\nThe typeToHTML function acts as an inadvertent execution sink; it retrieves the unsanitized string from the database and injects it directly into the Document Object Model (DOM) of the page without applying context-aware encoding. Consequently, any injected script tags or event attributes (such as onload or onerror) are parsed and executed by the browser.\nThe attack flow proceeds as follows: 1) The attacker initiates an HTTP POST request to the add.json.php endpoint containing a malicious JavaScript payload within the field_name parameter. 2) The server-side code processes this input and stores the payload in the database without modification. 3) A targeted user navigates to an administrative page or user profile that triggers the typeToHTML function. 4) The application pulls the malicious payload from the database and renders it into the victim's browser HTML. 5) The victim's browser interprets the malicious script as legitimate application code, executing it within the security context of the AVideo site.\nThis stored XSS vulnerability allows for sustained malicious activity, as the payload resides in the database and triggers every time the vulnerable component is rendered. The potential impact includes the theft of sensitive session cookies, manipulation of user profile data, unauthorized redirection to malicious external domains, and potential escalation of privileges by manipulating administrative UI elements through DOM manipulation.\nThe vulnerability affects all AVideo versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1. Exploitation requires administrative authentication to access the affected endpoint."
}