Description

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T13:06:23.127Z",
  "pubdate": "2026-09-03T13:06:23.127Z",
  "executiveSummary": "AVideo, through commit c91b5975d, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability located in the removePoster.php file.\nThis vulnerability exists because the application fails to implement mandatory security controls, specifically the absence of forbidIfNotPost or forbidIfInvalidToken checks, which are required to validate the authenticity of incoming requests.\nThe flaw allows a remote, unauthenticated attacker to induce an authenticated user’s browser to perform unauthorized actions by tricking the victim into executing a malicious GET request.\nThe primary impact of this vulnerability is the unauthorized deletion of live poster and thumbnail files associated with AVideo content.\nThis exploit relies on the victim maintaining an active session with the AVideo application and does not require the attacker to bypass authentication directly, as the victim's session tokens are automatically included by the browser.\nThe risk is significant as it allows for the disruption of service and integrity of media metadata without requiring direct interaction from the victim beyond viewing a malicious resource.",
  "technicalDetails": "The vulnerability resides within the removePoster.php script, which processes requests for the removal of image files associated with AVideo media content.\nThe root cause of this vulnerability is the failure to enforce server-side request validation protocols. Specifically, the script lacks essential security hooks such as forbidIfNotPost, which would restrict the method to HTTP POST, and forbidIfInvalidToken, which is necessary for verifying that the request originated from the legitimate application interface via a cryptographically secure anti-CSRF token.\nBecause the script accepts GET requests for a destructive operation, it bypasses standard state-changing security assumptions. An attacker can exploit this by embedding a specially crafted URL within an HTML tag, such as an <img> source or an anchor tag, hosted on an external site controlled by the attacker.\nWhen an authenticated AVideo administrator or user accesses the attacker-controlled page, their browser automatically appends their active session cookies to the GET request directed at the AVideo server.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious URL pointing to the vulnerable removePoster.php endpoint with the necessary parameters to identify the target poster or thumbnail file. 2) The attacker baits the authenticated victim into visiting a malicious site or viewing a crafted page containing the exploit trigger. 3) The victim's browser initiates a GET request to the target endpoint. 4) The AVideo server, lacking CSRF protections, processes the request as a legitimate action initiated by the authenticated user. 5) The server-side script executes the file system operation to delete the specified image files.\nThe vulnerability has a low barrier to entry, as it requires no sophisticated privilege escalation; it merely requires the victim to have an established, active session with the AVideo platform. The impact is primarily a Denial of Service (DoS) regarding the visual representation of media content and potential unauthorized modification of the content management system's media library state."
}