Executive Summary

This vulnerability exists in WWBN AVideo versions 26.0 and prior, where the admin panel renders plugin configuration values in HTML forms without proper output encoding such as htmlspecialchars(). Specifically, the jsonToFormElements() function in admin/functions.php directly inserts user-controlled values into textarea contents, option elements, and input attributes. This allows an attacker who can set a plugin configuration value—either by compromising an admin account or by exploiting a CSRF vulnerability on admin/save.json.php—to inject arbitrary JavaScript. This malicious script executes whenever any administrator visits the plugin configuration page.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks within the admin panel of the AVideo platform. An attacker injecting JavaScript can execute arbitrary code in the context of the administrator's browser session. This can result in theft of admin credentials, session hijacking, unauthorized actions performed with admin privileges, or further compromise of the system.

Useful 0 Not Useful 0

Mitigation Strategies

Since there are no publicly available patches at the time of publication, immediate mitigation steps include restricting administrative access to trusted users only and preventing attackers from setting plugin configuration values.

Additionally, administrators should avoid visiting the plugin configuration page until a patch or update is released, as visiting this page triggers the execution of injected JavaScript.

Implementing protections against CSRF attacks on admin/save.json.php can also help prevent attackers from chaining exploits to set malicious plugin configuration values.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to inject arbitrary JavaScript into the admin panel, which can lead to unauthorized actions or data exposure when administrators visit the plugin configuration page.

Such unauthorized code execution and potential data exposure could negatively impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure administrative controls.

However, the provided information does not explicitly describe the direct impact on compliance with these regulations.

Useful 0 Not Useful 0