GHSA-vvfw-4m39-fjqf
## Summary `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It does not call `forbidIfIsUntrustedRequest()`, does not verify a `globalToken`, and does not validate the Origin/Referer header. Because AVideo intentionally sets `session.cookie_samesite=None` to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, contact email, and more in a single request. ## Details The entire authorization and CSRF check for the endpoint is this block at `objects/configurationUpdate.json.php:10`: ```php require_once $global['systemRootPath'] . 'objects/user.php'; if (!User::isAdmin()) { die('{"error":"' . __("Permission denied") . '"}'); } ``` Immediately after, `$_POST` values are written straight into the global `AVideoConf` object and persisted: ```php // objects/configurationUpdate.json.php $config = new AVideoConf(); $config->setContactEmail($_POST['contactEmail']); // :21 $config->setLanguage($_POST['language']); // :22 $config->setWebSiteTitle($_POST['webSiteTitle']); // :23 $config->setDescription($_POST['description']); // :24 $config->setAuthCanComment($_POST['authCanComment']); // :25 $config->setAuthCanUploadVideos($_POST['authCanUploadVideos']); // :26 // Advanced (default enabled — $global['disableAdvancedConfigurations'] is empty by default): $config->setEncoderURL($_POST['encoder_url']); // :32 $config->setSmtp($_POST['smtp']); // :33 $config->setSmtpAuth($_POST['smtpAuth']); // :34 $config->setSmtpSecure($_POST['smtpSecure']); // :35 $config->setSmtpHost($_POST['smtpHost']); // :36 $config->setSmtpUsername($
Properties
- ghsa_id
- GHSA-vvfw-4m39-fjqf
- severity
- high
- summary
- WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
- cvss_score
- 8.3
- cve_id
- GHSA-vvfw-4m39-fjqf
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
- is_ghsa_only
- true
- ghsa_published
- 2026-04-14T23:12:30Z
- source_url
- https://github.com/advisories/GHSA-vvfw-4m39-fjqf
- ghsa_updated
- 2026-04-14T23:12:31Z
Related Entities (4)
AFFECTS (1)
VULNERABLE_TO (1)
HAS_WEAKNESS (1)
REPORTED_BY (1)
Explore deeper with Ninja Signal's threat intelligence graph