Executive brief
AVideo is a video hosting and streaming platform. The vulnerability allows authenticated users to manipulate video like/dislike counters, driving public like counts arbitrarily negative through a series of specially crafted requests. The corrupted counts persist permanently in the database and are visible across all video listings, pages, and feeds until manually repaired by an administrator.
Technical details
The vulnerability exists in Like::__construct() which performs counter arithmetic operations on raw $_GET['like'] values before validation occurs. By sending array-typed parameters (like like[]=1), attackers can exploit PHP's loose comparison semantics where arrays compare as greater than scalars, causing the initial counter checks to all evaluate false and skip counter updates. However, intval(array) returns 1, allowing the vote to be stored in the database. Subsequent legitimate requests then apply unmatched decrements, driving the counter negative. The attack requires authentication but no special privileges, and the Video::updateLikesDislikes() function lacks a floor at zero, allowing unbounded negative values. A fix requires normalizing the like parameter before any conditional checks and flooring the counter updates with GREATEST(0, likes - 1).
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-09-16: disclosed: Public disclosure via GitHub Security Advisory