Cross site scripting (XSS) in wwbn/avideo

published 2023-04-26 3y ago modified 2024-12-03 last yr.

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Description:

While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack.

Impact:

Since there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account

Step to Reproduce:

1. Click the link below

[https://demo.avideo.com/user?success="><img](https://demo.avideo.com/user?success=%22%3E%3Cimg) src=x onerror=alert(document.cookie)>

2. Then XSS will be executed

Patch / fix

fixed in 1

packagist wwbn/avideo 12.4

Is GHSA-2fch-hv74-fgw9 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
packagist	wwbn/avideo	<12.4	12.4

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-2fch-hv74-fgw9

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.