A critical cross-site request forgery vulnerability in WWBN AVideo versions 26.0 and earlier allows unauthenticated attackers to achieve remote code execution.

The application is vulnerable to Cross-Site Request Forgery (CWE-352) via the objects/pluginImport.json.php endpoint. Because the application lacks CSRF protection and uses permissive session cookie settings, an unauthenticated attacker can force an authenticated administrator to upload and execute a malicious PHP webshell.

Successful exploitation leads to full server compromise, allowing attackers to read, modify, or delete sensitive video data and underlying system files. With a CVSS score of 8.8, this vulnerability poses a high risk of total system takeover and potential lateral movement within the network, which could lead to severe operational disruption and loss of data integrity.

Immediate Action: As no official patched version is currently listed, administrators should restrict access to administrative endpoints via network-level controls or disable the plugin import functionality until a fix is released. Refer to the GitHub security advisory for updates regarding the availability of a patch.

Proactive Monitoring: Monitor server access logs for unusual POST requests to the objects/pluginImport.json.php endpoint originating from external or unexpected sources. Investigate any unauthorized plugin installations or modifications to the directory structure.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious CSRF attempts and unauthorized file upload patterns. Ensure that administrative interfaces are not exposed to the public internet.

Public Exploit Available: Unknown.

Given the potential for remote code execution, this vulnerability represents a significant threat to the security of the AVideo platform. Administrators must prioritize isolating administrative interfaces and monitoring for unauthorized file uploads. Once a vendor-supplied patch becomes available, it should be tested and deployed immediately to eliminate this critical attack vector.