AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

Summary

plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim.

Details

AVideo's PayPalYPT plugin ships two near-duplicate endpoints that cancel a PayPal billing agreement. Only one of them enforces ownership:

• plugin/PayPalYPT/PayPalAgreementCancel.json.php:19 — correctly requires either admin or the agreement's owner:

  if (!User::isAdmin() && !Subscription::isAgreementFromUser($_POST['agreement_id'], User::getId())) {
      $obj->msg = "Only the owner can delete his agreement";
      die(json_encode($obj));
  }
  

• plugin/PayPalYPT/agreementCancel.json.php:9-26 — only checks User::isLogged() (in fact twice, redundantly) and then calls the cancellation directly:

  if (!User::isLogged()) { ... die; }              // line 9
  if (empty($_REQUEST['agreement'])) { ... die; }   // line 14
  if (!User::isLogged()) { ... die; }              // line 19 — duplicate; no ownership check
  $plugin = AVideoPlugin::loadPluginIfEnabled("PayPalYPT");
  $agreement = PayPalYPT::cancelAgreement($_REQUEST['agreement']);  // line 26
  

PayPalYPT::cancelAgreement() at plugin/PayPalYPT/PayPalYPT.php:548-566 resolves the agreement ID against PayPal and calls $createdAgreement->suspend($agreementStateDescriptor, $apiContext) unconditionally — the server does not verify that the logged-in user's users_id matches the owner recorded in PayPalYPT_log (or wherever the agreement was registered):

public static function cancelAgreement($agreement_id)
{
    ...
    $createdAgreement = self::getBillingAgreement($agreement_id);
    try {
        $createdAgreement->suspend($agreementStateDescriptor, $apiContext);
        return Agreement::get($createdAgreement->getId(), $apiContext);
    } catch (Exception $ex) {
        return false;
    }
}

The intended UI caller is subscriptions_list.php:84 which posts the current user's own agreement IDs — but the server accepts any agreement parameter from any logged-in user. Agreement IDs can leak via _error_log entries written in agreementCancel.json.php:34 and during normal operation, via PayPal receipt emails, or via other administrative and payment-log screens. No CSRF token is required, but the root defect is missing authorization, not CSRF.