GHSA-2fch-hv74-fgw9

Suggest an improvement
Source
https://github.com/advisories/GHSA-2fch-hv74-fgw9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-2fch-hv74-fgw9/GHSA-2fch-hv74-fgw9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-2fch-hv74-fgw9
Published
2023-04-26T19:42:30Z
Modified
2023-04-26T19:48:16.409953Z
Summary
Cross site scripting (XSS) in wwbn/avideo
Details

Description:

While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack.

Impact:

Since there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account

Step to Reproduce:

  1. Click the link below

https://demo.avideo.com/user?success="><img src=x onerror=alert(document.cookie)>

  1. Then XSS will be executed
References

Affected packages

Packagist / wwbn/avideo

Package

Name
wwbn/avideo
Purl
pkg:composer/wwbn/avideo

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.4

Affected versions

10.*

10.4
10.8

Other

11

11.*

11.1
11.1.1
11.5
11.6