CVE-2026-88873 in AVideo
Summary
by MITRE • 09/10/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrators' browsers to request the endpoint, copying sensitive application logs to a publicly accessible zip file and truncating the live log to remove forensic evidence.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in WWBN AVideo represents a critical cross-site request forgery flaw within the view/logArchive.json.php component, specifically resulting from insufficient validation of state-changing requests. This security defect allows unauthenticated attackers to execute arbitrary actions on behalf of authenticated administrators without their knowledge or consent. The core technical issue lies in the absence of CSRF token verification for this specific endpoint, which permits any external web page to trigger a GET request that initiates sensitive administrative operations. By leveraging standard browser behavior where cookies and session identifiers are automatically included with requests made from different origins, an attacker can force a logged-in administrator's browser to interact with the vulnerable script without requiring authentication credentials directly in the malicious payload.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and evidence tampering. When triggered, the endpoint archives application logs into a zip file that becomes publicly accessible, effectively exposing sensitive internal information such as user sessions, configuration details, error traces, or other proprietary data contained within those logs. Simultaneously, the script truncates the live log files to remove forensic evidence of the attack itself. This dual-action capability not only compromises confidentiality by leaking critical system data but also undermines integrity and availability aspects of security by destroying audit trails that would otherwise aid in incident response and attribution. The ability to erase traces makes this vulnerability particularly dangerous for organizations relying on these logs for compliance monitoring or post-incident analysis.
From a classification perspective, this flaw aligns with CWE-352, which defines cross-site request forgery as the inclusion of untrusted data in state-changing requests without proper validation mechanisms such as anti-CSRF tokens or same-site cookie attributes. The attack vector described corresponds to ATT&CK technique T1078, specifically valid accounts used for unauthorized access and persistence, although here it is exploited via social engineering through malicious web pages rather than direct credential theft. Furthermore, the destruction of logs relates to ATT&CK tactic TA0005, Defense Evasion, where adversaries attempt to avoid detection by clearing or modifying system artifacts like log files.
Mitigation strategies must focus on implementing robust request validation mechanisms immediately. The primary fix involves integrating anti-CSRF tokens into all state-changing endpoints within the AVideo application, ensuring that each form submission and sensitive API call requires a unique, unpredictable token tied to the user's session. Additionally, developers should enforce strict SameSite cookie attributes set to Strict or Lax on session cookies to prevent them from being sent in cross-origin requests by default. Implementing custom request headers such as X-Requested-With: XMLHttpRequest can also provide an additional layer of verification since many browsers restrict access to these headers via JavaScript in cross-domain contexts. Regular security audits and code reviews focusing on CSRF protections across all administrative interfaces are essential to maintain the integrity of the application environment.