WWBN AVideo
CVE-2026-40928
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Network-delivered CSRF; attacker needs no privileges; victim interaction required; scope change warranted since forged comments affect other users' content view; no confidentiality exposure.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php), post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php), and/or delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights. Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.
AnalysisAI
Cross-site request forgery in WWBN AVideo 29.0 and prior allows unauthenticated attackers to force logged-in victims into performing state-changing actions - posting attacker-authored comments under the victim's identity, manipulating comment likes/dislikes, and deleting category assets when the victim holds management rights. Exploitation requires only that the victim loads an attacker-controlled HTML page, making the attack trivially deliverable via email, forum post, or any embedded image. No public exploit confirmed beyond SSVC poc status; no officially released patched version has been confirmed despite a fix commit existing upstream.
Technical ContextAI
This vulnerability is a classic CWE-352 (Cross-Site Request Forgery) affecting three PHP JSON endpoints in AVideo's objects/ directory: comments_like.json.php, commentAddNew.json.php, and categoryDeleteAssets.json.php. Each endpoint accepts state-changing requests via $_REQUEST or $_GET and binds resulting database mutations (INSERT/UPDATE on comments_likes, comment records, and category asset tables) to the caller's session user. AVideo already provides two CSRF-prevention primitives - forbidIfIsUntrustedRequest() in objects/functionsSecurity.php:138, which validates Referer/Origin against webSiteRootURL, and isGlobalTokenValid() in objects/functions.php:2313 - but these were only applied to objects/userUpdate.json.php and not to the three affected endpoints. The comments_like.json.php endpoint deliberately promotes $_GET['comments_id'] to $_POST['comments_id'] (lines 15-16), meaning the full attack is reachable via a plain <img src='…'> tag without even a form submission. CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*.
RemediationAI
Apply commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c directly to the AVideo installation; this adds forbidIfIsUntrustedRequest() calls to objects/categoryDeleteAssets.json.php, objects/commentAddNew.json.php, and objects/comments_like.json.php, enforcing Referer/Origin validation against webSiteRootURL. No officially tagged patched release has been confirmed - the Composer package entry shows fixed-in: None - so monitor the GHSA advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j for a versioned release. As an immediate compensating control, restrict external access to the three affected endpoints at the reverse proxy or WAF layer (block cross-origin requests to /objects/comments_like.json.php, /objects/commentAddNew.json.php, and /objects/categoryDeleteAssets.json.php); note this will disable those features for users whose client does not send a matching Origin/Referer header. Restricting the AVideo instance to a trusted internal network reduces the blast radius significantly at the cost of public accessibility.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today