The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
WWBN AVideo 11.6
WWBN AVideo dev master commit 3f7c0364
AVideo - https://github.com/WWBN/AVideo
9.6 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-79 - Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
AVideo is a web application, mostly written in PHP, that can be used to create an audio/video sharing website. It allows users to import videos from various sources, encode and share them in various ways. Users can sign up to the website in order to share videos, while viewers have anonymous access to the publicly-available contents. The platform provides plugins for features like live streaming, skins, YouTube uploads and more.
The PHP file
view/charts.php is a dashboard that shows several charts about the videos published for the current logged-in user.
... <body class="<?php echo $global['bodyClass']; ?>"> <?php include $global['systemRootPath'] . 'view/include/navbar.php'; include $global['systemRootPath'] . 'view/charts_body.php'; //  include_once $global['systemRootPath'] . 'view/include/footer.php'; ?> </body> ...
view/charts_body.php  which shows the body of the page:
jump GET parameter. It’s supposed to be used with a request like
https://192.168.200/view/charts.php?jump=commentthumbs for selecting the comments tab.
jump parameter is however not sanitized, leading to a straightforward reflected cross-site scripting issue (XSS). This can be used by an attacker, in the worst case, to take over an administrator account, for example by tricking an administrator into clicking on a link that triggers the XSS.
The XSS can be triggered with a request like
https://192.168.200/view/charts.php?jump=x%27);alert(1);//. It must be performed as a logged-in user.
Vendor confirms issues fixed on July 7th 2022
2022-07-05 - Vendor Disclosure
2022-07-07 - Vendor Patch Release
2022-08-16 - Public Release
Discovered by Claudio Bozzato of Cisco Talos.