Stored XSS in AVideo Video Trailer Field

Executive Summary

AVideo has a stored cross-site scripting (XSS) vulnerability in the video trailer1 field. User input in this field is not properly sanitized before being rendered within an inline onclick JavaScript string. Attackers with video upload permissions can exploit this by storing HTML entity-encoded payloads that bypass validation. When decoded by the browser, these payloads break out of the JavaScript string, allowing arbitrary code execution in the sessions of any visitors, including administrators.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect AVideo instances for unsanitized input in the video trailer1 field. Check if HTML entity-encoded payloads bypass validation and are stored in the database. Review JavaScript onclick handlers in Gallery or video pages for improper escaping. Look for payloads like `http://a/');alert(document.domain);//` in the trailer1 field.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code in the sessions of any visitors, including administrators. Impact includes session theft, unauthorized actions like changing admin settings, site defacement, or worm-like propagation across videos. Exploitation requires user interaction, such as clicking a Trailer button.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized modifications, or disclosure of protected health information, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest patched version if available. If no patch exists, apply output encoding using htmlspecialchars with ENT_QUOTES in the output sinks (e.g., plugin/CustomizeAdvanced/actionButtonGallery.php). Enhance isValidURL() to reject HTML entity sequences like ' or " to prevent bypass. Remove or sanitize stored payloads in the trailer1 field.

Useful 0 Not Useful 0