AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects\/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo’s automatic CSRF guard (autoCSRFGuard()\/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER[‘HTTP_REFERER’] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim’s playlist to be reordered and the victim’s browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.<\/p>\n","protected":false},"excerpt":{"rendered":"
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects\/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo’s automatic CSRF guard (au<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21000","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}