AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php
Summary
The install/test.php diagnostic script has its CLI-only access guard disabled by commenting out the die() statement. The script remains accessible via HTTP after installation, exposing video viewer statistics including IP addresses, session IDs, and user agents to unauthenticated visitors.
Details
The disabled guard at install/test.php:5-7:
if (!isCommandLineInterface()) {
//return die('Command Line only');
}The script also enables verbose error reporting:
error_reporting(E_ALL);
ini_set('display_errors', '1');It then queries VideoStatistic::getLastStatistics() and outputs the result via var_dump():
$resp = VideoStatistic::getLastStatistics(getVideos_id(), User::getId());
var_dump($resp);The VideoStatistic object contains: ip (viewer IP address), session_id, user_agent, users_id, and JSON metadata. The display_errors=1 setting also leaks internal filesystem paths in any PHP warnings.
The install/ directory is not restricted by .htaccess (it only disables directory listing via Options -Indexes) and no web server rules block access to individual PHP files in this directory.
Proof of Concept
# Request viewer stats for video ID 1
curl "https://your-avideo-instance.com/install/test.php?videos_id=1"Confirmed accessible on live AVideo instances (HTTP 200).
Impact
Unauthenticated disclosure of viewer IP addresses (PII under GDPR), session identifiers, and user agents. The enabled display_errors also reveals internal server paths on errors.
- CWE: CWE-200 (Exposure of Sensitive Information)
- Severity: Low
Recommended Fix
Uncomment the CLI guard at install/test.php:6 to restore the intended access restriction:
if (!isCommandLineInterface()) {
return die('Command Line only');
}Found by aisafe.io
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | wwbn/avideo | <= 26.0 | sin corrección |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N- Debilidad (CWE)
CWE-200- Plataforma
- Composer
- Paquete
wwbn/avideo- Publicada
- 04.04.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-hg8q-8wqr-35xx - CC BY 4.0
Historial de vulnerabilidades: wwbn/avideo
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 160
- Primera → última
- 04.2022 06.2026
- Sin corrección
- 143
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 14
- Alta 61
- Media 83
- Baja 2
Divulgaciones por año
- 2022: 2
- 2023: 5
- 2024: 5
- 2025: 0
- 2026: 148
-
AVideo: Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.