CVE-2026-34396: 
PHP vulnerability analysis and mitigation

CVE-2026-34396 is a stored Cross-Site Scripting (XSS) vulnerability in WWBN AVideo, an open source video platform, affecting versions 26.0 and prior. The flaw exists in the admin panel's plugin configuration rendering, where the jsonToFormElements() function in admin/functions.php interpolates user-controlled values into HTML forms without output encoding. It was published on March 31, 2026, with the advisory originally authored on March 27, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium), though the advisory notes the practical severity as High due to its chainability with a CSRF vulnerability (GitHub Advisory, AVideo Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored XSS). The jsonToFormElements() function in admin/functions.php contains at least four unsafe output points: textarea content (line 47), select option keys and values (line 55), input type and value attributes (lines 62–63), and a fallback input value attribute (line 75) — none of which apply htmlspecialchars() or equivalent encoding. Plugin configuration values are stored via admin/save.json.php, which lacks CSRF token validation (tracked as AVI-046), enabling an unauthenticated attacker to chain a CSRF request to plant the XSS payload, requiring only that an administrator visit a malicious page. The attack vector is network-based with low complexity, no privileges required, but user interaction (admin visiting the plugin config page) is needed (AVideo Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any administrator who visits the plugin configuration page. Consequences include theft of admin session cookies and CSRF tokens, creation of new admin accounts, modification of site-wide configuration (e.g., enabling file uploads or disabling security features), injection of persistent JavaScript into public-facing pages, and potential pivot to server-side code execution via plugin upload functionality. The scope change in the CVSS score reflects that the injected script can affect resources beyond the plugin configuration page itself (AVideo Advisory, GitHub Advisory).

1. Reconnaissance: Identify publicly accessible WWBN AVideo instances running version 26.0 or earlier, using search engines or Shodan to locate exposed admin panels.
2. Craft CSRF payload (unauthenticated path): Create a malicious HTML page containing a hidden form that auto-submits a POST request to https://target-avideo-instance.com/admin/save.json.php with parameters such as pluginName=PlayerSkins and a crafted skin value containing an XSS payload (e.g., x' onfocus=alert(document.cookie) autofocus=').
3. Lure administrator: Deliver the malicious page link to an AVideo administrator via phishing email, social engineering, or embedding in a trusted communication channel, causing their browser to silently submit the CSRF form.
4. Payload stored: The save.json.php endpoint, lacking CSRF token validation, accepts and stores the malicious plugin configuration value in the database.
5. XSS triggers: When any administrator navigates to the plugin configuration page, the jsonToFormElements() function renders the stored payload unescaped into an HTML input attribute, causing the injected JavaScript to execute in the admin's browser context.
6. Post-exploitation: The attacker's script can exfiltrate session cookies, create new admin accounts, modify site settings, or upload a malicious plugin to achieve server-side code execution (AVideo Advisory).

• Network: Unexpected POST requests to /admin/save.json.php from external or unfamiliar IP addresses, particularly with unusual pluginName parameter values or payloads containing HTML event handlers (e.g., onfocus, onerror, onload).
• Logs: Web server access logs showing POST requests to /admin/save.json.php without a valid referrer or with a cross-origin referrer; admin access logs showing visits to plugin configuration pages shortly after suspicious save requests.
• File System / Database: Plugin configuration values in the database containing HTML special characters, JavaScript keywords (alert, document.cookie, fetch, XMLHttpRequest), or attribute breakout sequences (e.g., ', ", >).
• Browser / Session: Unexpected admin account creation events; configuration changes (e.g., file upload settings enabled) with no corresponding legitimate admin activity; admin session tokens appearing in outbound requests to unknown external domains.

As of the vulnerability's publication date (March 31, 2026), no official patch is available for WWBN AVideo. The recommended fix is to apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to all user-controlled values rendered in admin/functions.php at lines 47, 55, 62–63, and 75. In the interim, administrators should restrict access to the admin panel to trusted networks via firewall rules or VPN, implement CSRF tokens on all admin forms (particularly save.json.php), and monitor admin accounts for unauthorized configuration changes. Administrators should also avoid visiting plugin configuration pages from untrusted sessions or browsers (AVideo Advisory, GitHub Advisory).

The vulnerability was discovered and reported by aisafe.io (credited as aisafe-bot as finder, adrgs as reporter) and published by the AVideo maintainer DanielnetoDotCom. No significant public commentary, media coverage, or notable researcher reactions beyond the advisory itself have been identified at this time (AVideo Advisory).