Threats affecting pkg:composer/AVideo

AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.

AVideo versions up to 25.0 have an authentication bypass vulnerability in the decryptMessage.json.php endpoint. This flaw allows unauthenticated remote attackers to submit private keys, ciphertext, and passphrases to perform server-side PGP message decryption without credentials. The vulnerability exposes sensitive key material to server logs and may enable resource exhaustion attacks.

AVideo versions up to 29.0 have an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint. The vulnerability allows an attacker who knows the Meet shared secret to upload a file with a crafted filename containing an arbitrary user ID, enabling passwordless login as that user, including admin. The shared secret can be obtained via path traversal or timing attacks against checkToken.json.php. This leads to full account takeover.

AVideo versions up to 27.0 contain a server-side request forgery (SSRF) vulnerability in the plugin/Live/test.php component. Authenticated administrators can exploit this flaw by manipulating the statsURL parameter, which lacks proper SSRF validation, to access arbitrary URLs including internal network addresses and cloud metadata endpoints. This can lead to exposure of sensitive information such as IAM credentials and internal service data.

AVideo versions up to 26.0 have multiple unauthenticated endpoints in payment plugins that lack authorization checks. These endpoints expose sensitive payment data including PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Attackers can access all payment transaction data, such as agreement IDs and user financial records, via direct GET requests without authentication.

A stored DOM Cross-Site Scripting (XSS) vulnerability exists in the YPTSocket plugin of the AVideo platform (WWBN). An unauthenticated attacker can inject arbitrary JavaScript via the webSocketSelfURI and page_title parameters, which are broadcast to all connected administrator clients viewing the YPTSocket online-users debug panel. This occurs because these parameters are stored without validation and later inserted into the DOM using jQuery's append method without proper sanitization. The vulnerability affects versions prior to 29.1.0 and has a CVSS score of 9.6, indicating critical severity.