WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw message POST parameter and passes it into sendSiteEmail(), which substitutes it directly into an HTML email template (via str_replace on the {message} placeholder) and renders it with PHPMailer::msgHTML(). There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled message between $_POST['message'] and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication. Commit https://github.com/WWBN/AVideo/commit/ contains an updated fix.

Affected: Packagist: wwbn/avideo

## Summary

`objects/notifySubscribers.json.php` takes the raw `message` POST parameter and passes it into `sendSiteEmail()`, which substitutes it directly into an HTML email template (via `str_replace` on the `{message}` placeholder) and renders it with `PHPMailer::msgHTML()`. There is no HTML sanitization, character escaping, or output encoding on the attacker-controlled `message` between `$_POST['message']` and the rendered email. Any authenticated user with upload permission can therefore broadcast arbitrary HTML — phishing links, tracking pixels, CSS/UI spoofing — to every subscriber on their channel (up to 10,000 recipients per invocation). The email is sent From: the platform's configured contact address and wrapped in the site's official logo and title, so attacker-supplied HTML arrives with the appearance of an official platform communication.

## Details

**File:** `objects/notifySubscribers.json.php`

```php 10: if (!User::canUpload()) { 11: forbiddenPage('You can not notify'); 12: } 13: forbidIfIsUntrustedRequest('notifySubscribers'); 14: $user_id = User::getId(); 15: // if admin bring all subscribers 16: if (User::isAdmin()) { 17: $user_id = ''; 18: } 19: 20: require_once 'subscribe.php'; 21: setRowCount(10000); ... 23: $Subscribes = Subscribe::getAllSubscribes($user_id); ... 34: $subject = 'Message From Site ' . $config->getWebSiteTitle(); 35: $message = $_POST['message']; 36: 37: $resp = sendSiteEmail($to, $subject, $message); ```

Controls present at…