Reflected XSS in AVideo Gallery Plugin via getBackURL Parameter

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo software. It occurs in the Gallery plugin when the SubCategorys feature is enabled. The getBackURL parameter is directly echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts via crafted URLs. When users interact with the Back control, the injected scripts execute in their browsers.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability in WWBN AVideo, inspect network traffic for requests to plugin/Gallery/view/Category.php with the getBackURL parameter. Look for URLs containing JavaScript code in the parameter value. Manually test by appending a payload like <script>alert(1)</script> to the getBackURL parameter and check if it executes in the response.

Useful 0 Not Useful 0

Impact Analysis

Attackers could steal user sessions, deliver malware, or perform actions on behalf of users. Victims may have their sensitive data exposed or accounts compromised if they interact with the Back control while the malicious URL is active.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if user data is compromised through this XSS flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to a version that patches this vulnerability. If an update is unavailable, apply input validation by sanitizing the getBackURL parameter using htmlspecialchars() with ENT_QUOTES and UTF-8 encoding. Alternatively, use the isSafeRedirectURL() function to validate the parameter before echoing it into the href attribute.

Useful 0 Not Useful 0