GitHub Security Advisory: GHSA-5hgj-7gm9-cff5
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-940: Improper Verification of Source of a Communication Channel
Vulnerable versions: <= 29.0
Patched in: unpatched

Summary: AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

Details:
## Summary

`objects/sendEmail.json.php` exposes two branches depending on whether `contactForm=1` is submitted. When the parameter is omitted, the endpoint sets `$sendTo` to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message `From:`/`Reply-To:`. The endpoint is explicitly allow-listed as a "public write action" in `objects/functionsSecurity.php` (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation.

## Details

**Vulnerable code (`objects/sendEmail.json.php`):**

```php
10: $valid = Captcha::validation(@$_POST['captcha']);
11: if(User::isAdmin()){
12:     $valid = true;
13: }
...
16: if ($valid) {
...
24:     $mail = new \PHPMailer\PHPMailer\PHPMailer();
25:     setSiteSendMessage($mail);           // uses site's SMTP credentials
...
30:     $replyTo = User::getEmail_();
31:     if (empty($replyTo)) {
32:         $replyTo = $config->getContactEmail();   // <-- FALLBACK to site's own email
33:     }
34:
35:     $sendTo = $_POST['email'];            // attacker-controlled recipient
36:
37:     // if it is from contact form send the message to the siteowner and the sender is the email on the form field
38:     if (!empty($_POST['contactForm'])) {
39:         $replyTo = $_POST['email'];
40:         $sendTo  = $config->getContactEmail();
41:     }
42:
43:     if (filter_var($sendTo, FILTER_VALIDATE_EMAIL)) {
44:         $mail->AddReplyTo($replyTo);       // site's address
45:         $mail->setFrom($replyTo);          // From: site's address
...
47:         $mail->addAddress($sendTo);        // TO: attacker-chosen victim
...
49:         $safeFirstName = htmlspecialchars($_POST['first_name'], ENT_QUOTES, 'UTF-8');
50:         $mail->Subject = 'Message From Site ' . $config->getWebSiteTitle() . " ({$safeFirstName})";
51:         $mail->msgHTML($msg);
...
55:         if (!$mail->send()) { ... }
```

**`User::getEmail_()` (`objects/user.php:345-352`):** returns `''` when the caller is not logged in, driving the fallback to `$config->getContactEmail()`.

**Endpoint is publicly callable.** `objects/functionsSecurity.php:879-918` lists `sendEmail.json.php` in the built-in "public write actions" CSRF/same-domain bypass:

```php
static $builtinBypass = [
    ...
    // Public write actions
    'sendEmail.json.php',
    ...
];
if (in_array($baseName, $builtinBypass, true)) { return; }
```

**Why existing defenses don't mitigate the abuse:**
- **Captcha** (`Captcha::validation`): costs one solve per email. Manual solves remain viable for targeted phishing, and a separate captcha-bypass primitive in this codebase (tracked separately) automates abuse.
- **`FILTER_VALIDATE_EMAIL`** (line 43): validates `$sendTo`