AVideo vulnerabilities

AVideo through version 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint. The notifyCode and callback parameters are concatenated into a shell command without escaping, allowing attackers to execute arbitrary OS commands as the web-server user.

In AVideo up to version 29.0, the listFFmpegProcesses() function in plugin/API/standAlone/functions.php interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

Stored Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI plugin of AVideo (versions 29.0 and below). An attacker can inject malicious JavaScript by setting a YouTube video title, which is then rendered on the AVideo homepage without HTML encoding.

AVideo prior to version 29.0 contains an unauthenticated Reflected XSS vulnerability in YouTubeAPI Gallery Pagination. The $_GET['search'] parameter is concatenated directly into the href attribute of pagination links without proper encoding, allowing arbitrary JavaScript injection.

WWBN AVideo versions 29.0 and below contain a Stored XSS vulnerability in the MessageSQLite WebSocket handler. An attacker can bypass sanitization by placing the payload in the 'json' key instead of 'msg', allowing arbitrary JavaScript execution in other users' browsers.

A stored XSS vulnerability in AVideo (Meet plugin) allows an attacker to inject malicious JavaScript via the User-Agent header when joining a public meeting. The payload is stored and later executed in the admin or host's browser session when viewing the participant list.

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.

AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter. The lack of isSSRFSafeURL() validation enables requests to private IP ranges and cloud metadata endpoints.

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records.

In AVideo 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.

AVideo is an open source video platform that is vulnerable to SSRF attacks in versions up to 29.0. Two endpoints improperly validate user-supplied URLs, allowing an attacker to redirect to internal resources.

AVideo versions up to and including 29.0 have a vulnerability in plugin/PayPalYPT/agreementCancel.json.php where a PayPal billing agreement is canceled using an attacker-supplied agreement parameter without verifying ownership. A low-privilege authenticated user can silently suspend another user's recurring subscription.

In AVideo versions up to and including 29.0, the objects/users.json.php endpoint exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter bypasses the admin-only guard in User::getAllUsers()/User::getTotalUsers(), and a second path accepts users_id and calls User::getUserFromID() without any permission check. Both paths return IDs, display names, channel URLs, photos, backgrounds, statuses, and the total account count.

AVideo versions up to and including 29.0 allow an authenticated user to configure a donation-notification webhook URL pointing to internal/loopback/metadata hosts. When another user donates, the server issues a curl POST to the attacker-supplied URL, resulting in blind SSRF. The handler uses only isValidURL() and does not call isSSRFSafeURL(), and CURLOPT_FOLLOWLOCATION is enabled without per-hop revalidation.

In AVideo up to and including 29.0, objects/userSavePhoto.php accepts a base64 POST parameter and writes decoded bytes to the profile photo, with only User::isLogged() access control. There is no CSRF token, Origin/Referer check, or MIME validation, and the default SameSite=None; Secure cookie policy allows an attacker to overwrite a logged-in user's profile photo and trigger clearCache(true).

AVideo up to and including 29.0 passes the raw 'message' POST parameter into sendSiteEmail(), which substitutes it directly into an HTML email template without sanitization or output encoding. Any authenticated user with upload permission can broadcast arbitrary HTML (phishing links, tracking pixels, UI spoofing) to all channel subscribers, up to 10,000 recipients per invocation.

In AVideo versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by redirecting to a URL containing the victim's stored password hash. Because the login endpoint accepts an encodedPass=1 flag that bypasses hashing, anyone who captures the redirect URL (via server logs, referrer leakage, or browser history) obtains a credential equivalent to the plaintext password and can fully take over the account, including admin accounts.

AVideo is an open-source video platform that, in versions up to 29.0, exposes the local CloneSite shared secret in the HTTP response to every unauthenticated request. This secret can be exploited by an attacker to impersonate the victim and gain access to the remote database.

AVideo is an open-source video platform that has a vulnerability in versions up to 29.0 allowing an unauthenticated attacker to send malicious messages via WebSocket. This vulnerability arises from improper JSON data handling, enabling PHP code execution on the server.

AVideo versions 29.0 and below contain an incomplete XSS fix in the ParsedownSafeWithLinks class that overrides inlineMarkup for raw HTML but does not override inlineLink() or inlineUrlTag(). This allows javascript: URLs in markdown link syntax to bypass sanitization. Commit cae8f0dadbdd962c89b91d0095c76edb8aadcacf contains an updated fix.

AVideo versions 29.0 and prior allow any unauthenticated client to force the server to generate a 1-character CAPTCHA word via the ql parameter in objects/getCaptcha.php without clamping or sanitization. Combined with a case-insensitive strcasecmp comparison over a ~33-character alphabet and the fact that failed validations do NOT consume the stored session token, an attacker can trivially brute-force the CAPTCHA on any endpoint in at most ~33 requests per session. Commit bf1c76989e6a9054be4f0eb009d68f0f2464b453 contains a fix.

In AVideo versions 29.0 and prior, the objects/commentDelete.json.php endpoint deletes comments without CSRF validation, not checking a token or Origin/Referer headers. Because the session cookie uses SameSite=None, an attacker-controlled page can automatically send a request with the victim's session and force mass comment deletion.

AVideo versions 29.0 and prior contain multiple JSON endpoints under objects/ that accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on a comment, post a comment authored by the victim on any video, and/or delete assets from any category.

In AVideo versions 29.0 and prior, the endpoint plugin/Live/view/Live_restreams/list.json.php contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch. Commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 fixes the issue.

In WWBN AVideo up to version 26.0, the file objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

WWBN AVideo, an open-source video platform, has a Server-Side Request Forgery (SSRF) vulnerability in the Live restream log callback flow. An authenticated streamer can store an arbitrary callback URL that is later fetched server-side. This affects versions 26.0 and prior.

AVideo is an open source video platform where the EPG feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization. A user with upload permission can set a malicious XML file with JavaScript in <title> elements. This affects versions 26.0 and prior.

WWBN AVideo versions 26.0 and prior have a vulnerability in the PayPal IPN v1 handler that lacks transaction deduplication. An attacker can replay a single IPN notification to repeatedly inflate wallet balance and renew subscriptions.

A vulnerability was found in AVideo version 26.0 and earlier in the install/deleteSystemdPrivate.php script. Due to a PHP operator precedence bug, the condition !php_sapi_name() === 'cli' always evaluates to false, allowing remote unauthenticated access to the script, which deletes files from the temp directory and discloses its contents.

WWBN AVideo up to and including 26.0 has a categories.json.php endpoint that fails to enforce user group-based access controls. In the default request path group filtering is skipped, exposing all non-private categories, and with the ?user= parameter a type confusion bug uses the admin user's (user_id=1) groups instead of the current user's. Commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 contains a fix.

In AVideo versions up to and including 26.0, the AI plugin's save.json.php endpoint loads AI response objects using an attacker-controlled id parameter without validating ownership of the referenced video. An authenticated user with AI permissions can reference any AI response ID.

WWBN AVideo up to and including 26.0 has a get_api_video_password_is_correct endpoint allowing any unauthenticated user to verify whether a password is correct for any password-protected video. The endpoint returns a boolean passwordIsCorrect field with no rate limiting, CAPTCHA, or authentication, enabling efficient brute-force attacks. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

In AVideo versions up to and including 26.0, the objects/playlistsVideos.json.php endpoint returns the full video contents of any playlist by ID without authentication or authorization checks. Private playlists (including watch_later and favorite types) are hidden from listing endpoints but their contents are directly accessible via the sequential integer playlists_id parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca contains a patch.

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.