CVE-2026-50182: 
PHP Schwachstellenanalyse und -minderung

CVE-2026-50182 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability in the AVideo YouTubeAPI Gallery Pagination feature of WWBN AVideo. The $_GET['search'] query parameter is concatenated without sanitization directly into href attributes of pagination links in plugin/YouTubeAPI/gallerySection.php, allowing any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by inducing them to follow a crafted URL. All versions up to and including v29.0 of the WWBN/AVideo Composer package are affected; no patched release has been published as of the advisory date. The vulnerability was published on May 28, 2026, and added to the GitHub Advisory Database on June 4, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, AVideo Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the absence of htmlspecialchars, urlencode, or any allow-list validation on $_GET['search'] before it is string-interpolated into <a href="..."> elements at lines 67 and 74 of plugin/YouTubeAPI/gallerySection.php. The PHP @ error-suppression operator used (@$_GET['search']) only silences undefined-index warnings and provides no sanitization. Two preconditions must be met: the YouTubeAPI plugin must be enabled with showGallerySection=true (the default), and the fulltext MySQL MATCH(v.title) AGAINST(<search>) query must return at least one result — a condition trivially satisfied by seeding the payload with a common word like video. A secondary amplification occurs because the AVideo Layout plugin (plugin/Layout/Layout.php:611) extracts all inline <script> blocks via regex and consolidates them into a single trailing script block before </body>, effectively lifting the injected payload out of the href attribute context and into a clean executable script block (GitHub Advisory, AVideo Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript in the victim's browser under the AVideo origin, enabling theft of non-HttpOnly session cookies, credential harvesting, and issuance of authenticated AJAX requests on behalf of the victim. When the victim is an AVideo administrator, the injected script can perform any admin action protected only by cookie-based authentication — including creating users, promoting accounts to admin, modifying site configuration, or installing plugins — effectively escalating a single click on a crafted link into full administrative takeover of the AVideo instance. Availability is not directly impacted, but confidentiality and integrity of both user data and site configuration are at risk (GitHub Advisory, AVideo Advisory).

1. Reconnaissance: Identify AVideo instances (WWBN/AVideo ≤ v29.0) with the YouTubeAPI plugin enabled and showGallerySection=true (the default configuration). Use search engines or tools like Shodan to locate publicly accessible AVideo deployments.
2. Verify precondition: Confirm the target has at least one video in its database whose title contains a common word (e.g., "video") to satisfy the MySQL fulltext MATCH(v.title) AGAINST(<search>) gate that controls gallery rendering.
3. Craft malicious URL: Construct a URL embedding the XSS payload in the search parameter, seeded with a common word to guarantee a fulltext hit, e.g.:

   https://avideo.example/?search=video%22%3E%3Cscript%3Ealert(1337)%3C%2Fscript%3E&page=2

   The payload video"><script>alert(1337)</script> closes the href attribute, closes the <a> tag, and injects a new <script> element.
4. Deliver to victim: Send the crafted URL to a target victim via phishing email, social media, or any other social engineering channel. No interaction beyond clicking the link is required.
5. Payload execution: When the victim's browser loads the page, the AVideo Layout plugin's organizeHTML() function extracts the injected <script> block from the href context and places it in a clean executable inline script block before </body>, causing the browser to execute the arbitrary JavaScript under the AVideo origin.
6. Achieve objective: Replace alert(1337) with a payload that exfiltrates session cookies, performs admin actions (e.g., creating a backdoor admin account), or establishes persistent access — particularly effective if the victim is an authenticated administrator (GitHub Advisory, AVideo Advisory).

• Network: HTTP GET requests to the AVideo homepage or gallery pages containing URL-encoded XSS payloads in the search parameter (e.g., %22%3E%3Cscript%3E, "><script>, or similar HTML-breaking sequences); unusual outbound requests from victim browsers to attacker-controlled domains shortly after page load.
• Logs: Web server access logs showing requests to /?search=... or /page/<n>?pageToken=...&search=... with encoded angle brackets, quote characters, or <script> fragments in the search parameter value; repeated requests from different IPs with identical malicious search payloads (indicating a distributed phishing campaign).
• Application Logs: AVideo application logs showing fulltext search queries containing tokens like script, alert, onerror, or other JavaScript keywords alongside common words used to satisfy the fulltext gate.
• Browser/Client Side: Unexpected JavaScript execution or network requests originating from the AVideo page context; session cookie theft evidenced by account takeover or admin actions not initiated by the legitimate user (GitHub Advisory).

The fix was committed to the WWBN/AVideo repository (commit f50fc03) and improves URL encoding for pagination links in gallerySection.php by applying proper encoding to the $_GET['search'] value before interpolation. As of the advisory date, no patched release version has been published for the Composer package (affected versions listed as ≤ 29.0 with "Patched versions: None"). Administrators should apply the patch from commit f50fc03 manually, or as a workaround, disable the YouTubeAPI plugin or set showGallerySection=false until an official patched release is available. Additionally, deploying a Web Application Firewall (WAF) rule to block requests with HTML-breaking characters in the search parameter can reduce exposure (GitHub Advisory, Fix Commit).