Reflected XSS in AVideo via confirmLivePassword.php

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in WWBN AVideo software. It occurs in the confirmLivePassword.php file where the application copies the REQUEST_URI value directly into a form's action attribute without proper encoding. Attackers can craft a malicious URL with a quote character to break out of the attribute and inject event handlers that execute in the victim's browser within the site origin.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the AVideo application for the affected files: plugin/Live/confirmLivePassword.php, plugin/CustomizeUser/confirmVideoPassword.php, and plugin/CustomizeAdvanced/confirmRating.php. Check if these files use $_SERVER['REQUEST_URI'] directly in HTML action attributes without encoding. Manually review the code for unencoded output in form actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to inject malicious JavaScript code via a crafted URL. When a user visits the link, the script executes in their browser within the AVideo site origin. This can affect any user, including administrators, who opens the malicious link. The impact includes potential theft of session cookies, account takeover, or unauthorized actions on behalf of the user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected AVideo versions may face compliance violations, legal liabilities, and reputational damage if user data is compromised through this XSS flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Apply input encoding to all instances where $_SERVER['REQUEST_URI'] is used in HTML attributes. Replace direct usage with htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES, 'UTF-8') in the affected files. Until a patch is available, this is the recommended mitigation to prevent XSS attacks.

Useful 0 Not Useful 0