AVideo: IDOR - 任何管理员都可以通过 setPassword.json.php 设置另一个用户的频道密码

The impact of CVE-2026-33297 is significant. An attacker can leverage this vulnerability to bypass channel-level access controls within wwbn/avideo. By exploiting this flaw, an attacker can effectively impersonate any user and gain unauthorized access to restricted content or functionality. This could lead to data breaches, unauthorized modifications, or disruption of services. The ease of exploitation – simply submitting a non-numeric password – makes this a high-risk vulnerability, particularly for systems with sensitive channel-protected content. The lack of proper input validation and sanitization is the root cause, allowing malicious input to bypass intended security measures.

Organizations using wwbn/avideo versions 25.0 and earlier, particularly those relying on channel-level access controls to protect sensitive content, are at significant risk. Shared hosting environments where multiple users share the same instance of wwbn/avideo are especially vulnerable, as an attacker compromising one user account could potentially bypass channel access for other users.

• wordpress / composer / npm:

grep -r 'setPassword.json.php' /var/www/avideo/

• generic web:

curl -I http://your-avideo-site.com/api/customizeuser/setPassword.json.php?user_id=1&password=a

• generic web: Check access logs for requests to /api/customizeuser/setPassword.json.php with non-numeric passwords.

1. 2026-03-19Disclosure

   disclosure

1. 已保留2026-03-18
2. 发布日期2026-03-19
3. 修改日期2026-04-07
4. EPSS 更新日期2026-03-31

The primary mitigation for CVE-2026-33297 is to upgrade to wwbn/avideo version 26.0 or later, which contains the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the underlying logic flaw, strict input validation on the setPassword.json.php endpoint can help. Specifically, reject any password submissions containing non-numeric characters. Monitor access logs for unusual password reset attempts. After upgrading, confirm the fix by attempting to set a password containing non-numeric characters; the operation should fail with an appropriate error message, and the password should not be set to '0'.

最后更新

29.0最近