Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a stored DOM-based Cross-Site Scripting (XSS) in the YPTSocket plugin of AVideo. The root cause is the lack of input sanitization for the page_title and webSocketSelfURI parameters provided by a user during WebSocket connection setup.
The attack flow is as follows:
/plugin/YPTSocket/getWebSocket.json.php. The webSocketSelfURI parameter in this request is not validated and is encoded into the WebSocket connection token by the getEncryptedInfo function.page_title and the crafted webSocketSelfURI.MessageSQLiteV2::onOpen function on the server processes these parameters. Before the patch, it stored them without proper sanitization. The page_title was only passed through utf8_encode, which is not an XSS mitigation, and webSocketSelfURI was not validated.updateSocketUserCard receives the malicious page_title. It dynamically constructs HTML and appends it to the DOM using jQuery's .append() method. This causes the browser to parse and execute the attacker's JavaScript payload in the context of the administrator's session.The patch in commit 8be71e53ccbe9b84b30870db386fb4d2b11e1c16 addresses the vulnerability in MessageSQLiteV2::onOpen by:
page_title using htmlspecialchars to prevent HTML and script injection.webSocketSelfURI to ensure it is a valid HTTP/HTTPS URL, preventing javascript: scheme injection.Therefore, the primary vulnerable function is MessageSQLiteV2::onOpen. The client-side sink is updateSocketUserCard.
MessageSQLiteV2::onOpenplugin/YPTSocket/MessageSQLiteV2.php
updateSocketUserCardplugin/YPTSocket/script.js
getEncryptedInfoplugin/YPTSocket/functions.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| WWBN/AVideo | composer | <= 29.0 |