PT-2026-29353 · Avideo · Yptwallet+1
Adrgs
·
Publicado
2026-03-31
·
Atualizado
2026-04-01
·
CVE-2026-34395
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
AVideo versions 26.0 and prior
Description
The
plugin/YPTWallet/view/users.json.php endpoint in AVideo allows any authenticated user to access personal information and wallet balances of all platform users. The endpoint incorrectly checks User::isLogged() instead of User::isAdmin(), bypassing the necessary authorization control. This allows any registered user to extract the complete user database, including Personally Identifiable Information (PII) such as emails, phone numbers, addresses, birth dates, real names, and financial data like wallet balances. The query in YPTWallet::getAllUsers() selects all columns from the users and wallet tables. While the cleanUpRowFromDatabase() function removes the password and recoverPass fields, other sensitive data remains exposed. The issue affects the API endpoint ''/plugin/YPTWallet/view/users.json.php'' which uses the User::isLogged() function for authorization. The vulnerable parameter is current and rowCount.Recommendations
Change
User::isLogged() to User::isAdmin() at plugin/YPTWallet/view/users.json.php:8.Exploit
Correção
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Avideo
Yptwallet