GitHub Security Advisory: GHSA-958h-qp3x-q4gj
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 4.2)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 29.0
Patched in: unpatched

Summary: AVideo: IDOR in PayPalYPT Plugin Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements

Details:
## Summary

`plugin/PayPalYPT/agreementCancel.json.php` cancels a PayPal billing agreement using an attacker-supplied `agreement` parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim.

## Details

AVideo's PayPalYPT plugin ships two near-duplicate endpoints that cancel a PayPal billing agreement. Only one of them enforces ownership:

- `plugin/PayPalYPT/PayPalAgreementCancel.json.php:19` — correctly requires either admin or the agreement's owner:
  ```php
  if (!User::isAdmin() && !Subscription::isAgreementFromUser($_POST['agreement_id'], User::getId())) {
      $obj->msg = "Only the owner can delete his agreement";
      die(json_encode($obj));
  }
  ```

- `plugin/PayPalYPT/agreementCancel.json.php:9-26` — only checks `User::isLogged()` (in fact twice, redundantly) and then calls the cancellation directly:

  ```php
  if (!User::isLogged()) { ... die; }              // line 9
  if (empty($_REQUEST['agreement'])) { ... die; }   // line 14
  if (!User::isLogged()) { ... die; }              // line 19 — duplicate; no ownership check
  $plugin = AVideoPlugin::loadPluginIfEnabled("PayPalYPT");
  $agreement = PayPalYPT::cancelAgreement($_REQUEST['agreement']);  // line 26
  ```

`PayPalYPT::cancelAgreement()` at `plugin/PayPalYPT/PayPalYPT.php:548-566` resolves the agreement ID against PayPal and calls `$createdAgreement->suspend($agreementStateDescriptor, $apiContext)` unconditionally — the server does not verify that the logged-in user's `users_id` matches the owner recorded in `PayPalYPT_log` (or wherever the agreement was registered):

```php
public static function cancelAgreement($agreement_id)
{
    ...
    $createdAgreement = self::getBillingAgreement($agreement_id);
    try {
        $createdAgreement->suspend($agreementStateDescriptor, $apiContext);
        return Agreement::get($createdAgreement->getId(), $apiContext);
    } catch (Exception $ex) {
        return false;
    }
}
```

The intended UI caller is `subscriptions_list.php:84` which posts the current user's own agreement IDs — but the server accepts any `agreement` parameter from any logged-in user. Agreement IDs can leak via `_error_log` entries written in `agreementCancel.json.php:34` and `webhook.php` during normal operation, via PayPal receipt emails, or via other administrative and payment-log screens. No CSRF token is required, but the root defect is missing authorization, not CSRF.

## PoC

1. Log in as any low-privilege user (registered subscriber, commenter, free-tier account created via `signUp`).
2. Obtain the target's PayPal agreement ID (e.g., `I-ABCD1234XYZ`). This may come from server error logs, email receipts, admin/payment screens, or other disclosures.
3. Send the request with the victim's agreement ID:

   ```