Stored XSS in AVideo CustomizeUser Plugin

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the AVideo software's CustomizeUser plugin. It occurs because the field_name parameter is stored without proper sanitization and later rendered as HTML without escaping. Administrators can inject malicious scripts via the add.json.php endpoint, which execute when users view extra info pages or profile forms that use the typeToHTML function.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect AVideo instances for the CustomizeUser plugin and check if the field_name parameter in add.json.php is unsanitized. Look for unusual JavaScript in extra info pages or profile forms. Review server logs for POST requests to add.json.php with admin privileges.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin privileges could inject malicious scripts that execute in the context of the AVideo application. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of the user. The impact depends on user privileges and actions taken after exploitation.

Useful 0 Not Useful 0

Compliance Impact

Stored XSS vulnerabilities can violate compliance requirements by exposing sensitive user data or enabling unauthorized access to systems handling personal or health information. GDPR may require breach notification, while HIPAA could consider this a security incident affecting protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest commit beyond c3edcc274c389816d434acadac07ee78eaf330c1. If no patch is available, disable the CustomizeUser plugin or restrict admin access to add.json.php. Implement input sanitization for the field_name parameter and monitor for suspicious activity.

Useful 0 Not Useful 0