Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php, causing a victim's playlist to be deleted when they visit the attacker's page while logged in.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T12:16:54.270Z",
  "pubdate": "2026-09-11T12:16:54.270Z",
  "executiveSummary": "WWBN AVideo contains a critical Cross-Site Request Forgery (CSRF) vulnerability in the playlistRemove.php component, affecting versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1.\nThe vulnerability allows an unauthenticated attacker to induce an authenticated user to perform unauthorized state-changing operations, specifically the permanent deletion of their saved playlists.\nThis flaw exists because the application fails to implement mandatory anti-CSRF token validation or supplementary authentication checks for requests directed at the playlist removal endpoint.\nThe impact includes loss of user data and potential disruption of service for end-users.\nExploitation requires the attacker to entice an authenticated victim into accessing a malicious webpage containing a forged request, thereby bypassing the victim's session security to execute unintended actions without their consent.\nThe risk is categorized as significant, as it demonstrates a failure in secure session management and authorization protocols within the web application's interface.",
  "technicalDetails": "The vulnerability originates within the playlistRemove.php file, which processes requests to delete user-generated content without enforcing adequate Cross-Site Request Forgery (CSRF) protections.\nRoot Cause: The application lacks a cryptographically secure, server-side validated token (often implemented as a hidden form field or header) that would otherwise verify that the incoming POST request originated from the legitimate application interface rather than an arbitrary third-party origin.\nExploitation Method: An attacker exploits this by constructing a malicious HTML document or script that submits a POST request to the target's playlistRemove.php endpoint. When an authenticated user visits the attacker-controlled page, the browser automatically includes the user's session cookies with the forged request.\nAttack Flow: 1. The attacker creates a hidden form or an AJAX request targeting the victim's playlistRemove.php endpoint with the necessary parameters (such as the playlist ID). 2. The attacker lures an authenticated AVideo user to the malicious host. 3. The victim's browser executes the POST request, attaching the active session credentials. 4. The server receives the request, identifies the user via their cookies, and processes the deletion command because it lacks anti-CSRF token verification. 5. The playlist is removed from the user's account without the victim's interaction or authorization.\nVulnerable Component: playlistRemove.php is the specific point of failure, as it acts as an entry point for administrative state changes without verifying the intent of the sender.\nAffected Versions: All versions of WWBN AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1 are susceptible to this vector.\nAuthentication and Privileges: The vulnerability relies on the victim maintaining an active, authenticated session. While the attacker does not need prior authentication, the impact is confined to the scope of the logged-in user's privileges.\nPost-Exploitation Impact: Successful exploitation leads to unauthorized data destruction. The attacker leverages the victim's session to modify account data, which, if conducted at scale, could result in significant user frustration and data loss within the AVideo environment."
}