CVE-2026-33507 Details

A remote code execution vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the 'objects/pluginImport.json.php' endpoint, which allows admin users to upload and install plugins. This endpoint lacks Cross-Site Request Forgery (CSRF) protection. Additionally, the application sets 'session.cookie_samesite' to 'None' for HTTPS connections, enabling an unauthenticated attacker to exploit this vulnerability. By crafting a page that an authenticated admin visits, the attacker can upload a malicious plugin containing a PHP web shell, thereby executing arbitrary code on the server. The vulnerability exploitation takes advantage of the absence of CSRF token validation and the permissive SameSite cookie policy, allowing the attack to bypass Cross-Origin Resource Sharing (CORS) restrictions and execute the web shell with the same privileges as the web server user.

To address this vulnerability, add CSRF token validation to the 'objects/pluginImport.json.php' endpoint. Update the plugin upload form in 'view/managerPluginUpload.php' to include the CSRF token, and consider changing the SameSite cookie attribute from 'None' to 'Lax' unless cross-origin cookie inclusion is explicitly required.