Description

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-22T13:16:38.673Z",
  "pubdate": "2026-08-22T13:16:38.673Z",
  "executiveSummary": "WWBN AVideo through commit 9c39d8c8 suffers from a Cross-Site Request Forgery (CSRF) vulnerability located within the releaseVideoNow.json.php endpoint. This security flaw enables remote malicious actors to force privileged users, such as administrators, into executing unintended state-changing actions via forged cross-site requests. The primary impact of this vulnerability is the unauthorized and permanent publication of embargoed videos by directly manipulating the videos_id parameter. The affected system is WWBN AVideo up to the specified commit. The risk implications are severe regarding content integrity and access control enforcement, as embargoed or restricted media can be prematurely or maliciously exposed to the public. Attacker capabilities include crafting malicious hyperlinks or embedding rogue content within third-party web pages that automatically trigger HTTP GET requests against the vulnerable target application. Exploitation requires the victim administrator to possess an active session cookie and interact with the attacker-controlled resource while authenticated, effectively bypassing authentication boundaries through implicit credential submission.",
  "technicalDetails": "The root cause of the vulnerability stems from an absolute lack of cryptographic authenticity checks, such as anti-CSRF tokens, and the improper handling of HTTP request methods within the releaseVideoNow.json.php endpoint. Specifically, the vulnerable component accepts state-modifying requests via the HTTP GET method instead of enforcing strict POST constraints alongside robust request validation mechanisms. Because browsers automatically attach session cookies to cross-origin requests directed at the application domain, an attacker can construct a malicious payload designed to invoke the releaseVideoNow.json.php script.\nThe exploitation method relies on tricking an authenticated administrator into loading a specially crafted URL or resource containing an injected request targeting the AVideo instance. The attack flow proceeds as follows: First, the attacker identifies or guesses the targeted videos_id associated with an embargoed or private video. Second, the attacker crafts a malicious hyperlink, image source, or iframe pointing directly to the vulnerable endpoint, appending the target videos_id as a parameter, such as /releaseVideoNow.json.php?videos_id=X. Third, the attacker distributes this malicious construct via social engineering, phishing, or by embedding it within a compromised website. Fourth, when an active administrator visits the attacker-controlled context, the browser automatically dispatches an HTTP GET request to the AVideo server, including the victim's valid session cookie.\nUpon receiving the request, the server-side logic processes the input due to the absence of origin validation and session token verification. The application executes the underlying function tied to releaseVideoNow.json.php, updating the database status of the specified videos_id from embargoed to published. The privilege requirements mandate that the victim must be an authenticated administrator capable of publishing content, while the network exposure is standard web accessibility over HTTP or HTTPS. The post-exploitation impact results in the permanent exposure of sensitive, restricted, or unreleased media assets, violating publishing schedules and organizational content policies."
}