Executive brief
WWBN AVideo, an open-source video hosting platform, contains a security flaw that allows an attacker to change the website's logo without authorization. By tricking a logged-in administrator into visiting a malicious webpage, an attacker can automatically overwrite the site's branding. This can be used to deface the website or facilitate phishing attacks by displaying fraudulent instructions to users.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'admin/customize_settings_nativeUpdate.json.php' endpoint of WWBN AVideo versions 26.0 and prior. The endpoint fails to validate CSRF tokens and processes base64-encoded image data via 'file_put_contents()' before the application's domain-based security checks are executed. Because the platform uses a 'SameSite=None' cookie policy, an attacker can host a malicious script that triggers a cross-origin POST request from an authenticated administrator's browser. This results in the platform's logo being overwritten on disk even if the subsequent database update is blocked by the ORM. A fix involves implementing 'isGlobalTokenValid()' checks before any file operations occur.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published by vendor
- 2026-04-06: disclosed: CVE published to NVD