Reflected XSS in AVideo via cancelUri Parameter

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in AVideo's userLogin.php file. The cancelUri parameter is echoed directly into an href attribute without proper HTML escaping after a protocol check. Attackers can inject malicious JavaScript via a relative URL containing embedded quotes and event handlers like onmouseover. The isSafeRedirectURL function only checks the protocol, not HTML characters, allowing attribute breakout.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability in AVideo, inspect userLogin.php for improper handling of the cancelUri parameter. Check if the parameter is echoed directly into an href attribute without HTML escaping. Use browser developer tools to test for XSS by injecting payloads like /" onmouseover="alert(1)// into the cancelUri parameter and observe if JavaScript executes on interaction.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can execute arbitrary JavaScript when users interact with the Cancel button. This could lead to session hijacking, defacement, or theft of sensitive data if users are tricked into hovering over the malicious link. The attack requires user interaction but no authentication.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply htmlspecialchars() with ENT_QUOTES|ENT_HTML5 to the cancelUri parameter before outputting it in the href attribute. This escapes quotes and prevents attribute breakout. Update AVideo to the latest commit or patch addressing this issue. Monitor network traffic for suspicious URLs containing event handlers or unusual cancelUri values.

Useful 0 Not Useful 0