GHSA-58h3-9722-fgpm: WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.php
WWBN AVideo 12.4 through 29.7.1 contains a path traversal vulnerability in the ADs plugin deleteImage.json.php that allows authenticated users with custom ads to delete arbitrary files. Attackers can set the unvalidated isregularuser parameter to another user's id or ../ sequences to delete other users' ads or files like videos/configuration.php, taking the site offline and re-exposing the installer.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has custom ads can exploit it. The attacker can manipulate the is_regular_user parameter to target another user's ID or use ../ path sequences.
What is the practical impact of exploitation?
An attacker can delete other users' advertisement files or arbitrary application files, including videos/configuration.php. Deleting that configuration file can take the site offline and expose the installer again.
Which versions are affected?
WWBN AVideo versions 12.4 through 29.7.1 are affected, specifically in the ADs plugin endpoint deleteImage.json.php.