在 WWBN AVideo 14.4 和 dev master commit 8a8954ff 的 videoNotFound 404ErrorMsg 参数功能中存在跨站脚本 (xss) 漏洞。精心构造的 HTTP 请求可能导致

This XSS vulnerability poses a significant risk because it allows attackers to inject malicious scripts into web pages viewed by authenticated users of WWBN AVideo. An attacker could craft a malicious HTTP request, enticing a user to visit a webpage containing the exploit. Upon visiting the page, the injected script would execute in the user's browser, potentially stealing session cookies, redirecting the user to a phishing site, or modifying the content of the page. The impact extends beyond simple defacement; attackers could gain complete control over user accounts and potentially access sensitive data stored within the AVideo system. The severity is heightened by the potential for widespread exploitation if the vulnerability is easily discoverable and exploitable.

Organizations using WWBN AVideo version 14.4, particularly those with publicly accessible video streaming services, are at significant risk. Shared hosting environments where multiple users share the same AVideo instance are especially vulnerable, as an attacker could potentially compromise other users' accounts through this vulnerability.

• php: Examine access logs for requests containing suspicious payloads in the videoNotFound parameter. Use grep to search for patterns indicative of XSS attempts.

grep 'videoNotFound=[^a-zA-Z0-9]*' access.log

• generic web: Use curl to test the affected endpoint with a simple XSS payload and observe the response for signs of script execution.

curl 'http://your-avideo-site.com/?videoNotFound=<script>alert(1)</script>'

• generic web: Check response headers for Content-Security-Policy (CSP) directives. Absence or weak CSP configurations increase the risk.

1. 2025-07-24Disclosure

   disclosure

1. 已保留2025-06-29
2. 发布日期2025-07-24
3. 修改日期2025-11-03
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-50128 is to immediately upgrade to version 14.4.1 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious patterns in the videoNotFound 404ErrorMsg parameter. Carefully review and sanitize all user-supplied input before rendering it in HTML. Implement strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious payload and verifying that the script is not executed.