GitHub Advisoryadvisory · Packagist

GHSA-2fch-hv74-fgw9 Cross site scripting (XSS) in wwbn/avideo

HIGH Published 2023-04-26 Modified 2023-04-26 Official page ↗
Ecosystem
Packagist
Packages
wwbn/avideo
Severity
High
Weaknesses
CWE-79
Reviewed
2023-04-26

Affected packages

• Packagist wwbn/avideo: < 12.4 → fixed in 12.4

Description

Description: While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack. Impact: Since there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account Step to Reproduce: 1. Click the link below [https://demo.avideo.com/user?success="> 2. Then XSS will be executed

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References