CyberRota Analysis
AI-GeneratedAVideo versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1 are vulnerable to a stored cross-site scripting (XSS) flaw due to improper sanitization of user input in category creation. This allows any authenticated user with upload permissions to inject malicious JavaScript, which can execute in the browsers of visitors, including administrators, potentially leading to unauthorized actions using the victim's session. Organizations using AVideo should prioritize patching this vulnerability, especially those with user-generated content features enabled.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.