VideoLAN VLC Media Player Web Interface 2.2.1 – Metadata Title Cross-Site Scripting
################################## # Andrea Sindoni - @invictus1306 # ################################## XSS vulnerability via metadata 1. Introduction Affected Product: VLC 2.2.1 / WEB INTERFACE Vulnerability Type: XSS 2. Vulnerability Description XSS vulnerability via metadata title 3. Proof of Concept 3.1 Launch: vlc.exe --http-host=127.0.0.1 --http-port=8080 --http-password=andrea 3.2 Open Browser and go to localhost:8080 (for more info see https://wiki.videolan.org/Documentation:Modules/http_intf/) 3.3 Then left username blank and password andrea 3.4 Select poc.mp3 (attached) file 3.5 See Attached image Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38706.zip |