| Package | Affected versions | Patched versions |
|---|---|---|
| wwbn/avideo | ≤ 26.0 | |
| avideo | ≤ 26.0 |
AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext.
File: objects/video.php
Vulnerable setter:
public function setVideo_password($video_password)
{
AVideoPlugin::onVideoSetVideo_password($this->id, $this->video_password, $video_password);
$this->video_password = trim($video_password);
}
Vulnerable getter:
public function getVideo_password()
{
if (empty($this->video_password)) {
return '';
}
return trim($this->video_password);
}
The value assigned to $this->video_password is only trim()-ed before being persisted to the database column video_password in the videos table. There is no call to any hashing function (e.g., password_hash(), sha256, or similar).
When a visitor enters a password to access a protected video, the comparison is done directly against the stored plaintext:
// Comparison at access check:
if ($video->getVideo_password() === $_POST['password']) { ... }
This means:
SELECT clean_title, video_password FROM videos WHERE video_password != '';Alternatively, exploit any of the SQL injection vulnerabilities already reported in this repository to extract the video_password column directly.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freepassword_hash($video_password, PASSWORD_BCRYPT) and verify on read using password_verify($_POST['password'], $stored_hash)