Listen to this Post
How the mentioned CVE works: The Live plugin’s “YouTube-style” view renders a stream key into an HTML class attribute using raw `` without htmlspecialchars(). An authenticated user with `canStream=1` can POST to `/plugin/Live/saveLive.php` with a malicious `key` containing a double quote followed by an event handler, e.g., " onmouseover="fetch(...). The `saveLive.php:30` assigns `$_REQUEST[‘key’]` verbatim to live_transmitions.key; no character filtering (only `&` and `=` stripped elsewhere, but not ", <, >). The database stores the payload. When any visitor (logged in or anonymous) opens the attacker’s live page (/plugin/Live/?u=<attacker>), `modeYoutubeLive.php:203` outputs <span class="_liveKey_<PAYLOAD>">. The double quote closes the class attribute, injecting `onmouseover` (or other handlers) into the HTML. Moving the mouse over the executes JavaScript in the victim’s browser, stealing cookies or performing authenticated actions. The same unescaped rendering affects admin stream details pages, escalating to admin context if an admin views it. The vulnerability is stored and triggers without user interaction beyond mouse-over (or via `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.