WWBN AVideo vulnerabilities

In WWBN AVideo 29.0 and earlier, the file objects/mention.json.php lacks authentication checks or an admin gate. It only has a simple entry guard: preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated user enumeration.

WWBN AVideo in version 29.0 and earlier does not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations. This opens a DNS-rebinding TOCTOU vulnerability.

WWBN AVideo version 29.0 and earlier contains a cross-site request forgery (CSRF) vulnerability in the 2FA toggle. An attacker can use a hidden form or fetch request without credentials to disable the victim's 2FA with a single POST request.

WWBN AVideo in version 29.0 and earlier has a stored cross-site scripting vulnerability in the Live plugin. The YouTube-style view renders the live stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor opening the stream's page executes attacker JavaScript in the platform origin.

WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.

In WWBN AVideo versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloadICS(), which builds an ICS calendar file. ICS::escape_string() only escapes commas and semicolons and does NOT neutralize CR/LF, so attacker CRLF bytes inside a property value break out and inject arbitrary ICS lines, including END:VEVENT / BEGIN:VEVENT pairs that add entire attacker-controlled calendar events. Because the malicious .ics file is served from the victim's trusted AVideo origin, this enables high-credibility calendar phishing.

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a "public write action" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix.

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a <script> block. An attacker who sends a victim to a crafted URL can break out of the string and execute arbitrary JavaScript in the victim's browser in the context of the AVideo origin. No authentication is required if a public Meet schedule exists on the target. Commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b contains an updated fix.

WWBN AVideo versions 29.0 and below contain a bypass of the directory traversal fix in objects/aVideoEncoderReceiveImage.json.php. The fix only checks the URL path for '..' sequences, while try_get_contents_from_local() uses explode('/videos/', $url) on the full URL string including the query string, allowing an attacker to place a /videos/../../ payload in the query string and read arbitrary files from the server filesystem.

WWBN AVideo versions 29.0 and below have an isValidDuration() regex without an end anchor, allowing arbitrary HTML/JavaScript to be appended after a valid duration prefix. The crafted duration is stored in the database and rendered without HTML escaping on trending pages, playlist pages, and video gallery thumbnails, resulting in stored XSS.

WWBN AVideo versions 29.0 and prior contain a `git.json.php` file that executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting), developer names and email addresses (PII), and commit messages that may reference internal systems or security fixes. No known patched versions are available.

WWBN AVideo up to version 26.0 allows an authenticated uploader to bypass SSRF validation via controlled downloadURL values with extensions .mp4, .mp3, .zip, .jpg, .png, .gif, .webm. The server fetches and stores the response as media, enabling SSRF response exfiltration.

In WWBN AVideo versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Other endpoints in the CloneSite directory require admin privileges. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

In WWBN AVideo versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. Other FFmpeg management endpoints require admin privileges.

In WWBN AVideo versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

WWBN AVideo versions 26.0 and prior have a vulnerability in the BlockonomicsYPT plugin's check.php endpoint. The endpoint returns payment order data for any Bitcoin address without requiring authentication, allowing an attacker to query payment records for any address used on the platform.

WWBN AVideo in versions 26.0 and prior contains a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint at admin/playerUpdate.json.php because it does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

WWBN AVideo open source video platform versions 26.0 and earlier have a CSRF vulnerability in the site customization endpoint. It lacks CSRF token validation and writes uploaded logo files before ORM security checks, allowing cross-origin POST to overwrite the logo.

WWBN AVideo up to version 26.0 has a vulnerability in the SocialMediaPublisher plugin where the publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

WWBN AVideo versions 26.0 and prior have an SSRF vulnerability in the EPG (Electronic Program Guide) feature. Authenticated users with upload permissions can store arbitrary URLs that the server fetches on every EPG page visit. Insufficient URL validation allows scanning internal networks and accessing internal services.

WWBN AVideo up to version 26.0 has a vulnerability in the User_Location plugin's testIP.php page that reflects the ip parameter without output encoding, allowing arbitrary HTML and JavaScript injection. Although the page is restricted to admins, the SameSite=None cookie configuration allows cross-origin exploitation. No public patches are available.

WWBN AVideo versions 26.0 and prior accept an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses admin-controlled moderation and draft workflows. The setStatus() method does not verify that the caller has permission to set that particular status.

WWBN AVideo versions 26.0 and prior have a vulnerability in the StripeYPT plugin. The test.php endpoint is accessible to any logged-in user, not just administrators. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID.

WWBN AVideo versions 26.0 and prior have a vulnerability in the CreatePlugin template for list.json.php, which lacks authentication or authorization checks. This results in 21 unauthenticated endpoints exposing sensitive data including user PII, payment transaction logs, IP addresses, and user agents.

WWBN AVideo versions 26.0 and prior have a vulnerability in the on_publish_done.php endpoint in the Live plugin that allows unauthenticated users to terminate any active live stream. An attacker can enumerate stream keys from the stats.json.php endpoint and send crafted POST requests to stop broadcasts.

WWBN AVideo versions 26.0 and prior have an XSS vulnerability in the YPTSocket plugin. The caller feature passes the caller's display name directly as raw HTML into the jQuery Toast Plugin. An attacker can set their display name to an XSS payload, and upon initiating a call, the code executes in any online user's browser without interaction.

WWBN AVideo allows admins to enable/disable plugins via objects/pluginSwitch.json.php without CSRF validation and bypassing Referer/Origin checks. An attacker can disable critical security plugins (e.g., 2FA) by luring an admin to a malicious page.

WWBN AVideo version 26.0 and prior allows admins to send HTML emails to all users via the objects/emailAllUsers.json.php endpoint. No CSRF token validation and SameSite=None on session cookies enable cross-origin CSRF attacks.

WWBN AVideo versions 26.0 and prior do not encode plugin configuration values before rendering in the admin panel. The jsonToFormElements() function in admin/functions.php directly interpolates user data into HTML elements, allowing arbitrary JavaScript injection.

WWBN AVideo versions 26.0 and prior have a vulnerability in the endpoint plugin/YPTWallet/view/users.json.php, which returns personal information and wallet balances of all users to any authenticated user. There is no admin privilege check.

WWBN AVideo up to version 26.0 lacks CSRF token validation in the admin plugin configuration endpoint (admin/save.json.php). Combined with SameSite=None cookie policy, an attacker can forge cross-origin POST requests to overwrite arbitrary plugin settings on an admin session. Bypassing table-level access controls allows full platform takeover.

WWBN AVideo versions up to and including 26.0 contain get_api_video_file and get_api_video API endpoints that return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. An unauthenticated attacker can retrieve direct playback URLs for any password-protected video by calling the API directly.

WWBN AVideo versions up to and including 26.0 contain a Time-of-Check-Time-of-Use (TOCTOU) race condition in the transferBalance() method in plugin/YPTWallet/YPTWallet.php. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, resulting in only one deduction while the recipient is credited multiple times.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the verifyTokenSocket() function in plugin/YPTSocket/functions.php has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legitimately obtained tokens to provide permanent WebSocket access, even after user accounts are deleted, banned, or demoted from admin. Admin tokens grant access to real-time connection data for all online users including IP addresses, browser info, and page locations. Commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 fixes the issue.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/Live/uploadPoster.php endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary live_schedule_id. The endpoint only checks User::isLogged() but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a socketLiveOFFCallback notification containing the victim's broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner's identity, allowing content hijacking and stream disruption. Commit 1e6dc20172de986f60641eb4fdb4090f079ffdce contains a patch.

WWBN AVideo versions up to and including 26.0: isSSRFSafeURL() validates URLs against private/reserved IP ranges before fetching, but url_get_contents() follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target.

WWBN AVideo versions up to and including 26.0 contain three list.json.php endpoints in the Scheduler plugin that lack any authentication check, while other endpoints in the same directories require User::isAdmin(). An unauthenticated attacker can retrieve all scheduled tasks, admin-composed email messages, and user-to-email targeting mappings via simple GET requests.