Vulnerability: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
Vulnerability ID: CVE-2022-27462
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/WWBN/AVideo
Published: 2022-04-05
File: objects/functions.php
Commit message: XSS vulnerability fix , thanks Max Boll
Commit author: Daniel

Vulnerable version (before fix):
 function getHostOnlyFromURL($url) {  */ function getDeviceID($useRandomString = true) {     $ip = md5(getRealIpAddr());     if (empty($_SERVER['HTTP_USER_AGENT'])) {         $device = "unknowDevice-{$ip}";         $device .= '-' . intval(User::getId());         return $device;     }      if (empty($useRandomString)) { function getDeviceID($useRandomString = true) {                 $device         );         $device .= '-' . intval(User::getId());         return $device;     }      $cookieName = "yptDeviceID"; function getDeviceID($useRandomString = true) {             return "getDeviceIDError";         }         $_COOKIE[$cookieName] = $_GET[$cookieName];         return $_GET[$cookieName];     }     return $_COOKIE[$cookieName]; }  function deviceIdToObject($deviceID) {

Fixed version (after fix):
 function getHostOnlyFromURL($url) {  */ function getDeviceID($useRandomString = true) {     $ip = md5(getRealIpAddr());     $pattern = "/[0-9a-z_.-]/i";     if (empty($_SERVER['HTTP_USER_AGENT'])) {         $device = "unknowDevice-{$ip}";         $device .= '-' . intval(User::getId());         return preg_replace($pattern, '-', $device);     }      if (empty($useRandomString)) { function getDeviceID($useRandomString = true) {                 $device         );         $device .= '-' . intval(User::getId());         return preg_replace($pattern, '', $device);     }      $cookieName = "yptDeviceID"; function getDeviceID($useRandomString = true) {             return "getDeviceIDError";         }         $_COOKIE[$cookieName] = $_GET[$cookieName];     }     return preg_replace($pattern, '', $_COOKIE[$cookieName]); }  function deviceIdToObject($deviceID) {

Patch:
patch: @@ -5783,10 +5783,11 @@ function getHostOnlyFromURL($url) {
  */
 function getDeviceID($useRandomString = true) {
     $ip = md5(getRealIpAddr());
+    $pattern = "/[0-9a-z_.-]/i";
     if (empty($_SERVER['HTTP_USER_AGENT'])) {
         $device = "unknowDevice-{$ip}";
         $device .= '-' . intval(User::getId());
-        return $device;
+        return preg_replace($pattern, '-', $device);
     }
 
     if (empty($useRandomString)) {
@@ -5797,7 +5798,7 @@ function getDeviceID($useRandomString = true) {
                 $device
         );
         $device .= '-' . intval(User::getId());
-        return $device;
+        return preg_replace($pattern, '', $device);
     }
 
     $cookieName = "yptDeviceID";
@@ -5816,9 +5817,8 @@ function getDeviceID($useRandomString = true) {
             return "getDeviceIDError";
         }
         $_COOKIE[$cookieName] = $_GET[$cookieName];
-        return $_GET[$cookieName];
     }
-    return $_COOKIE[$cookieName];
+    return preg_replace($pattern, '', $_COOKIE[$cookieName]);
 }
 
 function deviceIdToObject($deviceID) {
path: objects/functions.php