WWBN AVideo vulnerabilities

In WWBN AVideo versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Other endpoints in the CloneSite directory require admin privileges. The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.

In WWBN AVideo versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. Other FFmpeg management endpoints require admin privileges.

In WWBN AVideo versions 26.0 and prior, the install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.

WWBN AVideo versions 26.0 and prior have a vulnerability in the BlockonomicsYPT plugin's check.php endpoint. The endpoint returns payment order data for any Bitcoin address without requiring authentication, allowing an attacker to query payment records for any address used on the platform.

WWBN AVideo in versions 26.0 and prior contains a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint at admin/playerUpdate.json.php because it does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

WWBN AVideo open source video platform versions 26.0 and earlier have a CSRF vulnerability in the site customization endpoint. It lacks CSRF token validation and writes uploaded logo files before ORM security checks, allowing cross-origin POST to overwrite the logo.

WWBN AVideo up to version 26.0 has a vulnerability in the SocialMediaPublisher plugin where the publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

WWBN AVideo versions 26.0 and prior have an SSRF vulnerability in the EPG (Electronic Program Guide) feature. Authenticated users with upload permissions can store arbitrary URLs that the server fetches on every EPG page visit. Insufficient URL validation allows scanning internal networks and accessing internal services.

WWBN AVideo up to version 26.0 has a vulnerability in the User_Location plugin's testIP.php page that reflects the ip parameter without output encoding, allowing arbitrary HTML and JavaScript injection. Although the page is restricted to admins, the SameSite=None cookie configuration allows cross-origin exploitation. No public patches are available.

WWBN AVideo versions 26.0 and prior accept an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses admin-controlled moderation and draft workflows. The setStatus() method does not verify that the caller has permission to set that particular status.

WWBN AVideo versions 26.0 and prior have a vulnerability in the StripeYPT plugin. The test.php endpoint is accessible to any logged-in user, not just administrators. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID.

WWBN AVideo versions 26.0 and prior have a vulnerability in the CreatePlugin template for list.json.php, which lacks authentication or authorization checks. This results in 21 unauthenticated endpoints exposing sensitive data including user PII, payment transaction logs, IP addresses, and user agents.

WWBN AVideo versions 26.0 and prior have a vulnerability in the on_publish_done.php endpoint in the Live plugin that allows unauthenticated users to terminate any active live stream. An attacker can enumerate stream keys from the stats.json.php endpoint and send crafted POST requests to stop broadcasts.

WWBN AVideo versions 26.0 and prior have an XSS vulnerability in the YPTSocket plugin. The caller feature passes the caller's display name directly as raw HTML into the jQuery Toast Plugin. An attacker can set their display name to an XSS payload, and upon initiating a call, the code executes in any online user's browser without interaction.

WWBN AVideo allows admins to enable/disable plugins via objects/pluginSwitch.json.php without CSRF validation and bypassing Referer/Origin checks. An attacker can disable critical security plugins (e.g., 2FA) by luring an admin to a malicious page.

WWBN AVideo version 26.0 and prior allows admins to send HTML emails to all users via the objects/emailAllUsers.json.php endpoint. No CSRF token validation and SameSite=None on session cookies enable cross-origin CSRF attacks.

WWBN AVideo versions 26.0 and prior do not encode plugin configuration values before rendering in the admin panel. The jsonToFormElements() function in admin/functions.php directly interpolates user data into HTML elements, allowing arbitrary JavaScript injection.

WWBN AVideo versions 26.0 and prior have a vulnerability in the endpoint plugin/YPTWallet/view/users.json.php, which returns personal information and wallet balances of all users to any authenticated user. There is no admin privilege check.

WWBN AVideo up to version 26.0 lacks CSRF token validation in the admin plugin configuration endpoint (admin/save.json.php). Combined with SameSite=None cookie policy, an attacker can forge cross-origin POST requests to overwrite arbitrary plugin settings on an admin session. Bypassing table-level access controls allows full platform takeover.