Decoda contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'url' parameter in video markup or URLs in an image tag upon submission to the decoda/templates/video.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Upgrade to version 3.3.3 or higher, as it has been reported to fix this vulnerability. A workaround of disabling support for video markup has been described as possibly limiting vulnerability, as well.

• Exploit Database: 18822
• CVE ID: 2012-3830 (see also: NVD) 2012-3831 (see also: NVD)
• Secunia Advisory ID: 48931
• Bugtraq ID: 53332
• Vendor URL: http://milesj.me/code/php/decoda
• Other Advisory URL: http://www.redteam-pentesting.de/en/advisories/rt-sa-2012-002/-php-decoda-cross-site-scripting-in-video-tags
• Vendor Specific Solution URL: https://github.com/milesj/php-decoda/commit/104afad9d3cb1fbb766c4bc5b98e070a8a13fbd8
  https://github.com/milesj/php-decoda/commit/4068257bb4e1071d1d60577289d3da922c296c83
  https://github.com/milesj/php-decoda/commit/666778f326dff3bd213be9f624f0fcb337c0b4c9
  https://github.com/milesj/php-decoda/commit/dd8dab9a37a79361affb78c86b06773fb78dd3bc

• RedTeam Pentesting GmbH - RedTeam Pentesting GmbH