Description

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-22T13:16:38.403Z",
  "pubdate": "2026-08-22T13:16:38.403Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability has been identified in WWBN AVideo through commit 9c39d8c8, specifically within the objects/videoEditLight.php endpoint. This security flaw stems from the complete absence of request authenticity verification mechanisms, such as anti-CSRF tokens, combined with the insecure handling of state-changing operations via HTTP GET requests.\nThe vulnerability allows an unauthenticated remote attacker to manipulate video ownership parameters covertly. By leveraging stored Cross-Site Scripting (XSS) or HTML injection primitives—specifically by injecting a malicious img tag containing a crafted URI into a video description—an attacker can force an administrative user to unintentionally execute unauthorized state-changing requests when rendering the affected video page.\nSuccessful exploitation results in the complete loss of asset integrity and administrative control over the targeted media, as video ownership is illicitly transferred to an attacker-controlled account. The risk implications are severe for platforms relying on granular administrative access control, as unauthorized privilege abuse and resource hijacking undermine the entire multi-tenant security model. Remediation requires enforcing cryptographic request validation tokens and restricting state-changing functionalities strictly to non-idempotent HTTP methods such as POST.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of anti-CSRF protections and improper HTTP method handling within the application logic. The vulnerable component is located in objects/videoEditLight.php, which processes input parameters to modify video metadata and ownership attributes without validating the origin or intent of the request.\nThe endpoint improperly accepts HTTP GET requests for state-changing operations. Because GET requests are intended to be idempotent and retriable without side effects, browsers and network intermediaries routinely prefetch resources or follow embedded links, creating a vector for silent exploitation.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious payload containing an HTML img tag with a src attribute pointing to the objects/videoEditLight.php script on the target AVideo instance, appending parameters designed to reassign the target video ID to the attacker's user ID. Second, the attacker injects this payload into a video description field, which is subsequently stored in the database without adequate sanitization or output encoding. Third, when an authenticated administrator navigates to or views the page containing the malicious video description, the browser automatically attempts to render the img tag by issuing an HTTP GET request to the embedded source URL.\nBecause the administrator's session cookies are automatically included in the cross-site request by the browser, the AVideo application processes the request as a legitimate administrative action. Consequently, the objects/videoEditLight.php script executes the ownership reassignment logic without verifying any request authenticity tokens or validating user intent.\nThe technical requirements for this attack include network exposure of the AVideo instance, a victim with administrative privileges actively viewing the poisoned resource, and the ability of the attacker to store input within a video description field. The post-exploitation impact is characterized by the unauthorized escalation of control, allowing attackers to hijack valuable media assets and manipulate platform content integrity."
}