AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33479
CWE: CWE-94
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

## Summary The Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST['sections']` array values directly into PHP's `eval()` function. While the endpoint is gated behind `User::isAdmin()`, it has no CSRF token validation. Combined with AVideo's explicit `SameSite=None` session cookie configuration, an attacker can exploit this via cross-site request forgery to achieve unauthenticated remote code execution — requiring only that an admin visits an attacker-controlled page. ## Details **Vulnerable code** — `plugin/Gallery/view/saveSort.json.php:20-25`: ```php if(!empty($_REQUEST['sections'])){ $object = $gallery->getDataObject(); foreach ($_REQUEST['sections'] as $key => $value) { $obj->sectionsSaved[] = array($key=>$value); eval("\$object->{$value}Order = \$key;"); } $obj->error = !$gallery->setDataObject($object); } ``` The `$value` variable from `$_REQUEST['sections']` is interpolated directly into the string passed to `eval()` with no sanitization — no allowlist, no regex validation, no escaping. Normal Gallery usage sends section names like `'Shorts'`, `'Trending'`, etc. from jQuery UI sortable, but the server enforces no such constraint. **CSRF enablement** — `objects/include_config.php:134-137`: ```php if ($isHTTPS) { ini_set('session.cookie_samesite', 'None'); ini_set('session.cookie_secure', '1'); } ``` The session cookie is explicitly set to `SameSite=None`, which instructs browsers to


Mitigations:

Architectural layers (MAESTRO):