| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| wwbn/avideo | < 25.0 | 25.0 |
| avideo | < 25.0 | 25.0 |
Product: AVideo (https://github.com/WWBN/AVideo) Version: Latest (tested March 2026) Type: Insecure Direct Object Reference (IDOR) Auth Required: No User Interaction: None
The /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requiring authentication or authorization. An unauthenticated attacker can enumerate user IDs and retrieve playlist information including playlist names, video IDs, and playlist status for any user on the platform.
The endpoint accepts a users_id parameter and directly queries the database without any authentication or authorization check.
File: objects/playlistsFromUser.json.php
if (empty($_GET['users_id'])) {
die("You need a user");
}
// NO AUTHENTICATION CHECK
// NO AUTHORIZATION CHECK (does this user_id belong to the requester?)
$row = PlayList::getAllFromUser($_GET['users_id'], false);
echo json_encode($row);
There is no call to User::isLogged() or any comparison between the requesting user and the target users_id.
| File | Line | Issue |
|---|---|---|
objects/playlistsFromUser.json.php | 10-21 | No authentication or authorization check before returning playlist data |
curl "https://TARGET/objects/playlistsFromUser.json.php?users_id=1"
Response:
[
{"id":false,"name":"Watch Later","status":"watch_later","users_id":1},
{"id":false,"name":"Favorite","status":"favorite","users_id":1}
]
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャンAdd authentication and authorization checks:
// Option 1: Require authentication + only own playlists
if (!User::isLogged()) {
die(json_encode(['error' => 'Authentication required']));
}
if ($_GET['users_id'] != User::getId() && !User::isAdmin()) {
die(json_encode(['error' => 'Access denied']));
}
// Option 2: If public playlists are intended, filter by visibility
$row = PlayList::getAllFromUser($_GET['users_id'], false, 'public');