Description

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-22T13:16:38.130Z",
  "pubdate": "2026-08-22T13:16:38.130Z",
  "executiveSummary": "A cross-site request forgery vulnerability has been identified in AVideo through commit 9c39d8c8, specifically residing within the channelToGallery.json.php script.\nThis security flaw enables remote attackers to execute unauthorized writes to plugin data, thereby modifying critical site-wide Gallery configurations.\nThe primary impact of successful exploitation includes the unauthorized promotion of arbitrary channels to the front page or the malicious deletion of curated sections.\nThe vulnerability stems from an absence of proper anti-CSRF token validation mechanisms within the affected administrative endpoint.\nAttackers can leverage this weakness by crafting a malicious cross-site GET request designed to leverage an authenticated administrator's active session cookie.\nThe risk implication is significant, as administrative privilege abuse allows unauthorized manipulation of application state and content presentation without the administrator's explicit consent.\nExploitation requires the victimized administrator to interact with malicious content or a compromised third-party site while maintaining an active authenticated session on the target AVideo instance.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Request Forgery (CSRF) affecting the AVideo software up to commit 9c39d8c8.\nThe vulnerable component is the script located at channelToGallery.json.php, which handles backend configuration updates for the gallery plugin.\nThe root cause of the vulnerability is the complete lack of cryptographic nonce verification, anti-CSRF tokens, or robust request origin validation checks prior to processing state-changing actions.\nBecause the endpoint processes requests via the HTTP GET method without enforcing secure state-change primitives, it improperly trusts browser-supplied ambient authority.\nAttackers can exploit this by embedding malicious links, image tags, or automated scripts within external web pages or phishing vectors that target the AVideo administrative interface.\nWhen an authenticated administrator visits the malicious resource, the browser automatically attaches the valid session cookie for the AVideo application to the cross-site request targeting channelToGallery.json.php.\nUpon receiving the forged GET request, the server executes the associated plugin data write operations under the context of the victimized administrator.\nThe resulting payload behavior forces unauthorized modifications, such as promoting arbitrary channels to the front page or deleting curated sections.\nThe attack flow requires zero authentication bypass techniques, relying entirely on the browser's automatic inclusion of credentials and the server's failure to implement proper request validation.\nNetwork exposure is broad, as any externally accessible AVideo installation containing the vulnerable commit is susceptible to remote exploitation via browser-based attack vectors."
}