GHSA-2qq6-qfcq-jmr9: WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag
WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideosbody.php, executing in administrator sessions to install plugin archives containing PHP.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs low-privileged access sufficient to upload content and submit a crafted videoDownloadedLink value through objects/aVideoEncoder.json.php. No administrator privileges are required for the initial injection.
Is administrator interaction required for exploitation?
Yes. The stored payload executes when it is rendered in an administrator session through the manager videos interface, so an administrator must view the affected content.
What could an attacker do after the XSS executes in an administrator session?
The injected script can act in the administrator context to install plugin archives containing PHP. This creates a path from stored XSS to server-side PHP deployment through the administrative interface.