CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php), post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php), and/or delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights. Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php), post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php), and/or delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights. Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.

Summary

Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently:

1. Cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php).
2. Post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php).
3. Delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights.

Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource.

Details

AVideo exposes a helper, forbidIfIsUntrustedRequest() (objects/functionsSecurity.php:138), that rejects cross-origin requests when the Referer/Origin does not match webSiteRootURL. It is only invoked in one file in the tree — objects/userUpdate.json.php:18 — and is not applied to the endpoints below. There is also an isGlobalTokenValid() helper (objects/functions.php:2313) intended for CSRF-style token checks; none of the affected endpoints call it. allowOrigin() only sets CORS response headers and does not prevent cookie-bearing top-level or image requests from reaching the server.

1. objects/comments_like.json.php — CSRF → forced like/dislike

// objects/comments_like.json.php
15: if (empty($_POST['comments_id']) && !empty($_GET['comments_id'])) {
16:     $_POST['comments_id'] = $_GET['comments_id'];
17: }
18:
19: $like = new CommentsLike($_GET['like'], $_POST['comments_id']);
20: echo json_encode(CommentsLike::getLikes($_POST['comments_id']));

The endpoint deliberately promotes $_GET['comments_id'] to $_POST['comments_id'] so the call works for either verb. CommentsLike::__construct (objects/comments_like.php:18) reads User::getId(), calls load() to fetch any prior vote, then setLike() + save() — issuing an INSERT/UPDATE on comments_likes keyed to the session user (objects/comments_like.php:70-89). There is no token check and no origin check.

2. objects/commentAddNew.json.php — CSRF → forced comment posting

// objects/commentAddNew.json.php
34: if (!User::canComment()) {
35:     $obj->msg = __("Permission denied");
36:     die(json_encode($obj));
37: }
...
117: $objC = new Comment($_REQUEST['comment'], $_REQUEST['video']);
118: $objC->setComments_id_pai($_REQUEST['comments_id']);
...
124: $obj->comments_id = $objC->save();

All inputs come from $_REQUEST, so GET is fully supported. The only gate is User::canComment(), which is true for ordinary logged-in users. isCommentASpam() (lines 39–97) is a per-session rate limiter, not a CSRF defense — it accounts the victim's own session bucket, so it does not block a single forged write. The comment is persisted under the victim's users_id via $objC->save().

3. objects/categoryDeleteAssets.json.php — CSRF → forced deletion of category assets

// objects/categoryDeleteAssets.json.php
14: $obj->id = intval(@$_REQUEST['id']);
15:
16: if (!Category::canCreateCategory()) {
17:     $obj->msg = __("Permission denied");
18:     die(json_encode($obj));
19: }
20:
21: if (!Category::deleteAssets($obj->id)) {
22:     $obj->error = false;
23: ...

State-destroying operation reachable by GET with no CSRF defense. The attacker can enumerate category ids with a loop of <img> tags — every one fires a credentialed request.

Root cause (shared)

All three endpoints follow the same pattern: objects/*.json.php handler that (a) reads mutating parameters from $_REQUEST/$_GET, (b) performs authorization against the victim's session, and (c) writes to the database — without calling forbidIfIsUntrustedRequest(), without validating a CSRF token, and…

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php), post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php), and/or delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights. Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php), post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php), and/or delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights. Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.

Summary

Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently:

1. Cast/flip the victim's like/dislike on any comment (objects/comments_like.json.php).
2. Post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php).
3. Delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights.

Each endpoint is reachable from a browser via a simple <img src="…"> tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource.

Details

AVideo exposes a helper, forbidIfIsUntrustedRequest() (objects/functionsSecurity.php:138), that rejects cross-origin requests when the Referer/Origin does not match webSiteRootURL. It is only invoked in one file in the tree — objects/userUpdate.json.php:18 — and is not applied to the endpoints below. There is also an isGlobalTokenValid() helper (objects/functions.php:2313) intended for CSRF-style token checks; none of the affected endpoints call it. allowOrigin() only sets CORS response headers and does not prevent cookie-bearing top-level or image requests from reaching the server.

1. objects/comments_like.json.php — CSRF → forced like/dislike

// objects/comments_like.json.php
15: if (empty($_POST['comments_id']) && !empty($_GET['comments_id'])) {
16:     $_POST['comments_id'] = $_GET['comments_id'];
17: }
18:
19: $like = new CommentsLike($_GET['like'], $_POST['comments_id']);
20: echo json_encode(CommentsLike::getLikes($_POST['comments_id']));

The endpoint deliberately promotes $_GET['comments_id'] to $_POST['comments_id'] so the call works for either verb. CommentsLike::__construct (objects/comments_like.php:18) reads User::getId(), calls load() to fetch any prior vote, then setLike() + save() — issuing an INSERT/UPDATE on comments_likes keyed to the session user (objects/comments_like.php:70-89). There is no token check and no origin check.

2. objects/commentAddNew.json.php — CSRF → forced comment posting

// objects/commentAddNew.json.php
34: if (!User::canComment()) {
35:     $obj->msg = __("Permission denied");
36:     die(json_encode($obj));
37: }
...
117: $objC = new Comment($_REQUEST['comment'], $_REQUEST['video']);
118: $objC->setComments_id_pai($_REQUEST['comments_id']);
...
124: $obj->comments_id = $objC->save();

All inputs come from $_REQUEST, so GET is fully supported. The only gate is User::canComment(), which is true for ordinary logged-in users. isCommentASpam() (lines 39–97) is a per-session rate limiter, not a CSRF defense — it accounts the victim's own session bucket, so it does not block a single forged write. The comment is persisted under the victim's users_id via $objC->save().

3. objects/categoryDeleteAssets.json.php — CSRF → forced deletion of category assets

// objects/categoryDeleteAssets.json.php
14: $obj->id = intval(@$_REQUEST['id']);
15:
16: if (!Category::canCreateCategory()) {
17:     $obj->msg = __("Permission denied");
18:     die(json_encode($obj));
19: }
20:
21: if (!Category::deleteAssets($obj->id)) {
22:     $obj->error = false;
23: ...

State-destroying operation reachable by GET with no CSRF defense. The attacker can enumerate category ids with a loop of <img> tags — every one fires a credentialed request.

Root cause (shared)

All three endpoints follow the same pattern: objects/*.json.php handler that (a) reads mutating parameters from $_REQUEST/$_GET, (b) performs authorization against the victim's session, and (c) writes to the database — without calling forbidIfIsUntrustedRequest(), without validating a CSRF token, and…