Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) issue in the AVideo platform's Live plugin. It consists of two main parts: storing the malicious payload and rendering it without proper escaping.
Payload Storage: An attacker with streaming permissions can make a POST request to plugin/Live/saveLive.php to set a custom stream key. This script calls the LiveTransmition::setKey function to save the key in the database. The setKey function does not perform any validation or sanitization, allowing payloads like \" onmouseover=\"alert(1)\" to be stored.
Payload Execution: When a user visits the live stream page (plugin/Live/?u=<attacker-username>), the plugin/Live/view/modeYoutubeLive.php template is used for rendering. This template directly includes the stream key in a class attribute of a <span> tag using <?php echo $livet['key'] ?>. Since the key is not escaped, the browser interprets the stored payload as HTML, leading to the execution of the malicious script.
The provided patch fixes the rendering part by using htmlspecialchars() to escape the key. The identified vulnerable function LiveTransmition::setKey is the root cause on the input side, allowing the malicious data to be persisted in the first place.
LiveTransmition::setKeyObjects/LiveTransmition.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| WWBN/AVideo | composer | <= 29.0 |