CVE-2017-17649

Vulnerability

Readymade Video Sharing Script version 3.2 contains an HTML injection vulnerability in the single-video-detail.php page. The comment parameter is not properly sanitized, allowing an attacker to inject arbitrary HTML code via a crafted HTTP request. The vulnerability is present in all installations of version 3.2 as identified by the vendor and security researchers [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a GET request to single-video-detail.php with a malicious comment parameter. No authentication is required, and the attacker only needs network access to the vulnerable script. The proof of concept shows a simple request like http://localhost/[PATH]/single-video-detail.php?video_id=MTMy&comment=[CODE]&comment_submit= where [CODE] is the injected HTML [1].

Impact

Successful HTML injection allows the attacker to embed arbitrary HTML content into the page. This can be used to deface the site, inject phishing forms, or load external resources. Since JavaScript execution may be possible depending on browser security policies, the impact could extend to cross-site scripting (XSS) scenarios, leading to information disclosure or session theft. The attack requires no elevated privileges and affects any user viewing the injected comment [1][2].

Mitigation

As of the published date (2017-12-18), no official patch or updated version has been released by the vendor. The affected version is 3.2, and users are advised to apply input validation and output encoding on the comment parameter. Temporary workarounds include disabling the comment functionality or using a web application firewall (WAF) to block malicious input patterns. This vulnerability is not listed on the CISA KEV [1][2].