Executive brief
AVideo is a video content management system that allows unauthenticated user registration. An attacker can inject malicious JavaScript into the phone field during signup; when administrators later view the user management page, the injected script executes in their browser, potentially allowing the attacker to steal admin credentials or perform unauthorized actions. This vulnerability requires no authentication and only bypasses a simple image captcha.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the user registration endpoint (/userCreate.json.php). The root cause is that the setPhone() method in objects/user.php stores the phone field without sanitization (no strip_tags() or htmlspecialchars()), unlike the setName() method which properly sanitizes input. The phone value is persisted to the database and later fetched by users.json.php, then rendered by the jQuery bootgrid library via tbody.html(rows) (innerHTML), which executes any injected HTML/JavaScript in the admin's browser context. Attack preconditions are minimal: only solving a simple CAPTCHA during registration is required. A patch has been released (commit 1adcb75) that adds strip_tags() to the setPhone() method to prevent tag injection.
Affected products
- WWBN AVideo 29.0
Timeline
- 2026-07-22: disclosed
- 2026-08-11: advisory: NVD publication
- 2026: patched: Patch released via commit 1adcb75