IET-OU Open Media Player timedtext.php webvtt cross site scripting

Successful exploitation of CVE-2019-25086 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to a variety of malicious outcomes, including stealing session cookies, redirecting users to phishing sites, or injecting malicious content into the application's interface. The vulnerability's remote accessibility significantly broadens the attack surface, as it can be triggered without requiring prior authentication. The impact is amplified if the Open Media Player is integrated into a larger application, as the XSS vulnerability could be leveraged to compromise the entire system.

Organizations using Open Media Player in their web applications, particularly those relying on older versions (1.0-1.5.0), are at risk. Shared hosting environments where multiple users share the same Open Media Player installation are especially vulnerable, as an attacker could potentially compromise other users' accounts.

• php: Examine application logs for requests to /application/controllers/timedtext.php with unusual or malformed ttml_url parameters. Use grep to search for patterns indicative of XSS payloads within these requests.

grep 'ttml_url=[^a-zA-Z0-9]' /path/to/access.log

• generic web: Use curl to test the endpoint /application/controllers/timedtext.php with a crafted ttml_url parameter containing a basic XSS payload (e.g., <script>alert(1)</script>).

curl 'http://example.com/application/controllers/timedtext.php?ttml_url=<script>alert(1)</script>'

1. 2019-06-19Discovery

   discovery

2. 2022-12-27Disclosure

   disclosure

1. Réservé2022-12-27
2. Publiée2022-12-27
3. Modifiée2024-08-05
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2019-25086 is to upgrade Open Media Player to version 1.5.1 or later, which includes the fix (patch 3f39f2d68d11895929c04f7b49b97a734ae7cd1f). If upgrading is not immediately feasible, consider implementing input validation and sanitization on the ttmlurl parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious requests targeting the timedtext.php file with unusual ttmlurl parameters.