CVE-2025-50128
📋 TL;DR
A stored cross-site scripting vulnerability in WWBN AVideo allows attackers to inject malicious JavaScript via the videoNotFound 404ErrorMsg parameter. When users visit a specially crafted webpage, arbitrary code executes in their browser context. This affects WWBN AVideo 14.4 and development versions.
💻 Affected Systems
- WWBN AVideo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, redirect users to malicious sites, perform actions on behalf of authenticated users, or install malware via drive-by downloads.
Likely Case
Session hijacking, credential theft, defacement of pages, or redirection to phishing sites.
If Mitigated
Limited impact if proper input validation, output encoding, and Content Security Policy are implemented.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious page) but no authentication to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
Monitor vendor for patches. Implement input validation and output encoding on the videoNotFound 404ErrorMsg parameter.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to HTTP headers
Input Validation Filter
allSanitize videoNotFound parameter input to remove script tags and JavaScript
Implement server-side filtering for <script>, javascript:, and on* attributes
🧯 If You Can't Patch
- Disable or restrict access to the vulnerable videoNotFound functionality if not essential
- Implement web application firewall rules to block XSS payloads in the 404ErrorMsg parameter
🔍 How to Verify
Check if Vulnerable:
Test by injecting <script>alert('XSS')</script> into the videoNotFound 404ErrorMsg parameter and checking if it executesCheck Version:
Check AVideo version in admin panel or configuration filesVerify Fix Applied:
Verify that script injection attempts are properly sanitized or blocked and no longer execute📡 Detection & Monitoring
Log Indicators:
- HTTP requests with script tags or JavaScript in videoNotFound parameter
- Unusual 404 error patterns
Network Indicators:
- HTTP traffic containing malicious script payloads in URL parameters
SIEM Query:
source="web_logs" AND (uri="*videoNotFound*" AND (uri="*<script>*" OR uri="*javascript:*"))