Stored XSS in AVideo User Registration via Unsanitized Phone Field

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in AVideo, an open-source video platform. It occurs because user input in the phone field during registration is not properly sanitized. Attackers can inject malicious JavaScript that gets stored in the database. When administrators view the user management page, the unsanitized phone value is rendered via innerHTML, executing the script in the admin's browser session.

Useful 0 Not Useful 0

Detection Guidance

Check AVideo user registration forms for unsanitized phone field inputs. Inspect database entries in the users table for phone values containing JavaScript code or HTML tags. Review admin user management pages for rendered phone values that execute scripts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of an administrator's browser session. Potential impacts include session theft, full admin account takeover, site defacement, and malware distribution. Attackers can leverage this to gain unauthorized access to sensitive data or control over the platform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal data, potential data breaches, and lack of proper input validation. GDPR requires protection of personal data, while HIPAA mandates safeguards for sensitive health information. Exploitation could result in data exposure, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 1adcb75458a3b31058655698a833e8cbde4d0593. Update setPhone() to use strip_tags() on input. Sanitize phone values in users.json.php. Monitor for suspicious user registrations with script payloads in phone fields.

Useful 0 Not Useful 0