Executive brief
AVideo is a live streaming platform that allows users to schedule broadcasts with titles and descriptions. The application stores these user-supplied fields without sanitization and displays them on publicly accessible pages, allowing attackers with streaming permissions to inject malicious scripts that execute in viewers' browsers. An unauthenticated viewer merely needs to open a reminder link to trigger the stored attack, potentially leading to credential theft or malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in AVideo's Live_schedule class, where the setTitle() and setDescription() methods accept user input directly from POST parameters without any sanitization (CWE-79). The vulnerable input flows from plugin/Live/view/Live_schedule/add.json.php, which passes $_POST values directly to these setters, then stores them unmodified in the database. The attack surface includes the unauthenticated remindMe.php endpoint and modeYoutubeLive.php, both of which render these fields without HTML escaping. An authenticated user with streaming permission can store malicious payloads (e.g., img onerror tags), and any unauthenticated visitor opening the reminder link will execute the attacker's JavaScript in their browser. The vulnerability is an implementation oversight—neighboring classes in the codebase properly sanitize identical user-text fields using functions like xss_esc() and HTMLPurifier. No patch has been released as of the advisory date.
Affected products
- WWBN AVideo current (e01e41ecc) and earlier
Timeline
- 2026-08-18: disclosed
- 2026-09-01: advisory