Rajivraj

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get api preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get api signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get api preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users id field in the response body discloses the authenticated identity (users id:1 on success, users id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** The API fails to enforce rate limits when clients use a bot User-Agent header. This allows attackers to bypass eight protected operations, including login brute-force protection, by sending requests with a bot User-Agent to disable rate limiting. Consequently, an attacker can perform unlimited password guessing attempts against any account from a single IP address. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** AVideo generates passwords for external-login accounts using the `rand()` function instead of a cryptographically secure generator, which limits the output to 31-bit integers. Additionally, the software uses unsalted MD5-based hashing for these passwords. This combination allows attackers who obtain the password hashes to recover the plaintext passwords quickly via offline brute-force attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** Broken access control in the 'videoViewsInfo' endpoint allows unauthenticated callers to retrieve complete user records when a `hash` parameter is provided. The exposed data includes password hashes, recovery tokens, and live session identifiers. This can lead to the hijacking of viewer sessions, including those of administrator accounts, and the unauthorized acquisition of sensitive personal data for all video viewers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** A path traversal issue exists in the 'notify.ffmpeg.json.php' endpoint. Unauthenticated attackers can write files to arbitrary locations within the application root and subdirectories by providing a custom path via the `avideoRelativePath` parameter. This is possible because the system allows the replay of previously issued ciphertext as a `notifyCode` token, which is decrypted but not validated, effectively bypassing authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** When the YPTSocket plugin is enabled, a cross-site scripting issue exists via the websocket callback mechanism. Unauthenticated attackers can execute arbitrary JavaScript in the browsers of other users by sending crafted socket messages. This occurs when callback names resolve to global functions, such as `avideoConfirmHTML()`, which accept untrusted data and assign it to `innerHTML`, allowing script execution in the victim's origin without authentication or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** Broken access control exists in the unauthenticated 'feed/index.php' endpoint. When the `program id` parameter is supplied, per-video visibility checks are disabled. This allows attackers to enumerate playlist identifiers and retrieve unlisted or group-restricted videos by requesting the RSS feed with any visible playlist ID, including empty playlists that may return the entire hidden video catalogue of the site. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions prior to 29.0 **Description** An authentication failure exists where the `video id hash` acts as a non-expiring and non-revocable bearer token. A bearer token is a security token that grants access to whoever possesses it. This flaw allows an attacker who obtains a `video id hash` to replay it indefinitely to authenticate as the video owner, granting full administrator session access and privileges. Because the token is non-revocable, it remains valid even after the account owner changes their password. **Recommendations** Update WWBN AVideo to a version newer than 29.0. Review web and access logs for unexpected authenticated sessions. Rotate affected credentials where supported.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo (affected versions not specified) **Description** An issue exists in the 'get.json.php' endpoint when the `APIName` is set to 'channels'. Unauthenticated attackers can manipulate the `sort column` parameter to perform a SQL injection. This allows the ordering of results by arbitrary database columns, such as `users.password` and `users.recoverPass`. By using this ordering oracle, attackers can infer password hash values and recovery tokens. Additionally, this can trigger SQL errors that reveal the full query statement and the database schema. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** Improper validation of access controls on the public channel page allows unauthenticated visitors to view unlisted and group-restricted videos. This occurs through the use of hardcoded visibility flags and an undefined property. Attackers can access the channel endpoint to retrieve sensitive content, such as full URLs to unlisted videos and thumbnails of member-only content, bypassing the `hidePrivateVideos` setting. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo versions e01e41ecc and earlier **Description** Three security controls during the login process rely exclusively on the client-supplied `User-Agent` header. The functions `isAVideoEncoder()` and `isAVideoMobileApp()` compare the `HTTP USER AGENT` against hardcoded literals ("AVideoEncoder" or "AVideoMobileApp") without verifying the IP address or using a shared secret. An attacker with valid credentials can set the `User-Agent` to "AVideoEncoder" to bypass two-factor authentication, skip brute-force captcha escalation, and avoid being recorded in the login and device audit history. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** A cross-site request forgery (CSRF) issue exists in the 'plugin/API/set.json.php' endpoint. This flaw allows attackers to execute state-changing actions by crafting GET requests that bypass CSRF protection, which is a security mechanism designed to prevent unauthorized commands from being transmitted from a user that the web application trusts. By directing a victim's browser to a malicious URL, an attacker can delete videos, deactivate accounts, or modify playlists without the user's interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** A missing authentication flaw exists in the `plugin/Live/on publish.php` file. Unauthenticated attackers can mark arbitrary scheduled broadcasts as failed by sending crafted POST requests to the unguarded RTMP callback endpoint. By providing fabricated stream keys following the pattern `-ps-<N>`, an attacker can modify scheduled broadcast status fields and silently cancel live broadcasts without requiring credentials or authorization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers. This allows attackers to spoof the client address used by the `enforceRateLimit()` function. By rotating the header values in each request, an attacker can bypass login rate limiting to perform unlimited credential guessing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVideo (affected versions not specified) **Description** The `setTitle()` and `setDescription()` functions in `Live schedule` store POST input without proper sanitization. This allows users with streaming permissions to inject malicious scripts. Additionally, unauthenticated attackers can access the 'remindMe.php' endpoint to execute stored Cross-Site Scripting (XSS) payloads—a technique where malicious scripts are permanently stored on the target server—in the browsers of victims without requiring authentication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo (affected versions not specified) **Description** A path traversal issue exists in the 'get api login code' API endpoint. Unauthenticated attackers can delete arbitrary .log files by providing directory traversal sequences in the `code` parameter. This allows for the destruction of audit logs and the ability to probe for file existence on the server, resulting in both file deletion and information disclosure regarding the filesystem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `code` parameter in the 'get api login code' API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo (affected versions not specified) **Description** Insufficient validation of password recovery token expiration occurs in the 'userRecoverPassSave.json.php' endpoint. This allows an attacker who has obtained a recovery token to use it indefinitely to reset a target account password and gain full access to the account. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo (affected versions not specified) **Description** An unauthenticated credential submission issue exists in the 'plugin/Live/api/preauthorize.json.php' endpoint. The system accepts credentials via the GET method without implementing rate limiting, which is a mechanism used to control the frequency of requests to a server. This allows attackers to repeatedly submit credentials to perform sustained password guessing attacks or trigger an unlimited number of two-factor confirmation emails. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo (affected versions not specified) **Description** An issue exists in the `isSSRFSafeURL()` function that fails to normalize NAT64 addresses written in hexadecimal form. This allows attackers to bypass server-side request forgery (SSRF) protections by using hex-encoded NAT64 addresses to access loopback interfaces and cloud metadata services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WWBN AVideo (affected versions not specified) **Description** An issue exists in the 'sendEmail.json.php' endpoint that allows authenticated administrators to send emails from the site contact address by bypassing origin checks and captcha validation. This occurs via Cross-Site Request Forgery (CSRF), a technique where a malicious website tricks a user's browser into performing an unwanted action on a different website where the user is authenticated. Attackers can create a malicious page that, when visited by an admin, sends emails with custom subjects and bodies to any recipient. Because the emails originate from the legitimate server, they pass SPF, DKIM, and DMARC validation, facilitating phishing and brand impersonation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.