PT-2026-26000 · Avideo · Avideo
Offensiveee
·
Publicado
2026-03-17
·
Atualizado
2026-03-22
·
CVE-2026-33043
CVSS v3.1
8.1
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
AVideo versions 25.0 and below
Description
AVideo, an open source video platform, has an issue where the
/objects/phpsessionid.json.php endpoint exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true, which enables cross-origin session theft and full account takeover. An attacker can host a malicious page that, when visited by a logged-in AVideo user, steals their PHP session ID due to the permissive CORS policy. This allows the attacker to impersonate the user with full privileges. The vulnerable file is objects/phpsessionid.json.php, and the vulnerable function is allowOrigin(). The allowOrigin() function is located in objects/functions.php (line ~2648). The vulnerability allows an attacker to make a credentialed cross-origin request and read the session ID.Recommendations
Versions prior to 26.0 should be updated.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Avideo