Executive brief
AVideo is a popular open-source video platform. An unauthenticated attacker can inject malicious code into the video statistics database by sending a crafted HTTP request, which then executes in the browser of video owners and administrators when they view video statistics, potentially compromising their accounts or enabling session hijacking.
Technical details
This is a stored cross-site scripting vulnerability in AVideo's video statistics feature. The unauthenticated endpoint objects/videoAddViewCount.json.php accepts a User-Agent header and writes it to the videos_statistics database via VideoStatistic::save() without invoking the existing sanitizing setter setApp(). Instead, it passes the unfiltered User-Agent through getUserAgentInfo(), which returns unrecognized agent strings verbatim, and only applies a 45-character length cap. When video owners or administrators view the statistics page (view/videoViewsInfo.php), the stored app field is rendered via DataTables 1.12.1 using an unescaped renderer that assigns content via innerHTML, causing the injected HTML and JavaScript to execute in their authenticated session. An attacker with any IP address can plant multiple statistics rows and craft a User-Agent payload of up to 29 characters that bypasses the length restriction and executes arbitrary JavaScript.
Affected products
- WWBN AVideo through 29.0 (revision e01e41ecc)
Timeline
- 2026-09-16: disclosed
- 2026-09-01: advisory: GitHub Security Advisory GHSA-6rgh-c296-5j86 published