Description

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-30T15:16:45.160Z",
  "pubdate": "2026-08-30T15:16:45.160Z",
  "executiveSummary": "WWBN AVideo is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability located within the sendEmail.json.php script.\nThe vulnerability allows an authenticated administrator to be coerced into triggering unauthorized email transmissions via the application's configured contact address.\nBy bypassing origin validation and captcha protections, an attacker can perform arbitrary mail relaying from the server's legitimate identity.\nThis vulnerability poses a significant risk for phishing campaigns, as emails appear to originate from a trusted domain, potentially satisfying SPF, DKIM, and DMARC checks.\nSuccessful exploitation requires the victim to have an active administrative session and interact with a malicious or compromised third-party web page crafted by the attacker.\nThe impact includes reputational damage, facilitate of large-scale credential harvesting, and the potential for domain blacklisting due to malicious mail relaying.",
  "technicalDetails": "The vulnerability resides in the file 'sendEmail.json.php' within the WWBN AVideo framework. The root cause is the lack of proper anti-CSRF token validation or origin verification during the processing of HTTP requests intended to trigger the mailer function.\nIn a standard implementation, an email-sending function would typically mandate a session-bound token (nonce) to ensure the request originated from the intended administrative dashboard. In this instance, the server-side logic fails to enforce this check, permitting state-changing requests to be processed regardless of the request's origin.\nThe exploitation flow initiates when an authenticated administrator visits a malicious web page controlled by an attacker. This page contains hidden HTML elements, such as an invisible form or an automated JavaScript XMLHttpRequest/Fetch call, configured to target the 'sendEmail.json.php' endpoint on the vulnerable AVideo installation.\nBecause the administrator is already authenticated, the browser automatically attaches the victim's session cookies to the forged request. The server receives the request, identifies the session as having administrative privileges, and proceeds to execute the mail-sending function.\nThe attacker exercises full control over the 'subject' and 'body' parameters of the mail request, while the 'to' recipient address can also be specified. Consequently, the attacker can deliver highly convincing phishing lures to arbitrary targets.\nFurthermore, because the mail is transmitted via the application's own backend mailer, it inherits the legitimate server credentials and configuration. This ensures that the messages successfully pass standard email authentication protocols, specifically SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). This authentication bypass effectively weaponizes the victim's own infrastructure to facilitate brand impersonation, drastically increasing the likelihood of target engagement with the malicious content."
}