PT-2026-44849 · Avideo · Authorize.Net+2
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
AVideo versions 29.0 and earlier
Description
An issue exists in the 'plugin/AuthorizeNet/processPayment.json.php' endpoint that allows any logged-in user to add arbitrary funds to their own wallet when the AuthorizeNet and YPTWallet plugins are enabled. The endpoint credits the user's wallet based solely on the attacker-controlled
amount POST parameter without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This occurs because the endpoint hardcodes the $paymentSuccess variable to true and calls the addBalance() function of the YPTWallet plugin without performing actual payment verification.Recommendations
For versions 29.0 and earlier, remove or disable the 'plugin/AuthorizeNet/processPayment.json.php' file if it is obsolete. Implement a verified Authorize.Net transaction ID and server-side amount lookup before calling the
addBalance() function. As a temporary mitigation, disable the AuthorizeNet or YPTWallet plugins to prevent unauthorized wallet credits.Exploit
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avideo
Authorize.Net
Yptwallet