AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33685
CWE: CWE-862
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

## Summary The `plugin/AD_Server/reports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected. ## Details The vulnerable file `plugin/AD_Server/reports.json.php` loads the application configuration at line 5 but never checks whether the request comes from an authenticated admin user: ```php // plugin/AD_Server/reports.json.php:1-10 <?php header('Content-Type: application/json'); require_once '../../videos/configuration.php'; // Fetch request parameters with safety checks $startDate = !empty($_REQUEST['startDate']) ? $_REQUEST['startDate'] . ' 00:00:00' : null; $endDate = !empty($_REQUEST['endDate']) ? $_REQUEST['endDate'] . ' 23:59:59' : null; $reportType = isset($_REQUEST['reportType']) ? $_REQUEST['reportType'] : null; ``` Compare with the HTML page at `plugin/AD_Server/reports.php:6-8`, which correctly gates access: ```php if (!User::isAdmin()) { forbiddenPage(__("You cannot do this")); exit; } ``` And `plugin/AD_Server/getCSV.php:4-6`: ```php if (!User::isAdmin()) { forbiddenPage('You must be Admin'); } ``` The JSON endpoint exposes five report types, each querying joined tables that include user and video metadat


Mitigations:

Architectural layers (MAESTRO):