Attack Chain

1. Attacker (with uploader privileges) inputs a malicious script, typically an event-handler payload embedded within a URL host, into the 'videoDownloadedLink' parameter.
2. The application stores the unescaped malicious payload via 'objects/aVideoEncoder.json.php'.
3. An administrator navigates to the 'view/managerVideos_body.php' page, which renders the stored malicious payload within a Source tag.
4. The script executes within the context of the administrator's active session.
5. The attacker leverages the administrative session to upload or install malicious plugin archives containing PHP backdoors.

Impact

Successful exploitation allows an attacker to execute arbitrary scripts in an administrator's browser session. This can be used to perform administrative actions, such as installing arbitrary plugin archives, leading to potential full remote code execution on the underlying server.

Recommendation

Inventory all deployments of WWBN AVideo. Since no patch is identified in the source, restrict administrative access and uploader privileges until an update is provided by the vendor. Hunt for anomalous plugin installations or suspicious entries in the 'videoDownloadedLink' field within the AVideo database.