Summary
AVideo's unauthenticated installer endpoint generates a PHP configuration file by inserting request parameters into PHP string literals without escaping them. When the configuration file is absent, an attacker may inject PHP code and achieve arbitrary command execution as the web-server user.
AVideo's unauthenticated installer endpoint generates a PHP configuration file by inserting request parameters into PHP string literals without escaping them. When the configuration file is absent, an attacker may inject PHP code and achieve arbitrary command execution as the web-server user.
Affected context
The vulnerability affects AVideo deployments using the installer endpoint while videos/configuration.php is absent, such as during initial deployment or after the file has been removed or relocated. The generated file is directly requestable, and its output path is derived from a supplied systemRootPath without an apparent base-directory restriction. Exploitation also depends on the supplied path containing index.php and the installer establishing a database connection using attacker-controlled connection parameters.
The vulnerability affects AVideo deployments using the installer endpoint while videos/configuration.php is absent, such as during initial deployment or after the file has been removed or relocated. The generated file is directly requestable, and its output path is derived from a supplied systemRootPath without an apparent base-directory restriction. Exploitation also depends on the supplied path containing index.php and the installer establishing a database connection using attacker-controlled connection parameters.
Exploit preconditions
- Attack surface: Unauthenticated HTTP access to
install/checkConfiguration.php - Required access: No target account or target database credentials; the attacker must be able to send crafted installer parameters
- Trigger point: Generation and subsequent loading of
videos/configuration.php - Environmental condition: The expected configuration file must be absent; an existing file prevents the endpoint from taking this path
- Additional conditions: The supplied
systemRootPathmust containindex.php, and the submitted database connection must succeed - Why exploitation is possible: Request values are interpolated into executable PHP source without context-appropriate escaping, while the output path is insufficiently constrained
- Attack surface: Unauthenticated HTTP access to
install/checkConfiguration.php - Required access: No target account or target database credentials; the attacker must be able to send crafted installer parameters
- Trigger point: Generation and subsequent loading of
videos/configuration.php - Environmental condition: The expected configuration file must be absent; an existing file prevents the endpoint from taking this path
- Additional conditions: The supplied
systemRootPathmust containindex.php, and the submitted database connection must succeed - Why exploitation is possible: Request values are interpolated into executable PHP source without context-appropriate escaping, while the output path is insufficiently constrained
Why this happens
The installer treats untrusted request parameters as source-code fragments when constructing a PHP configuration file. Because values are inserted into single-quoted PHP literals without escaping or safe serialization, input can alter the generated program rather than remain data. This is a classic CWE-94 code-injection pattern, compounded by attacker-influenced file placement and an unauthenticated installation workflow. Related interpolation into SQL statements also creates a separate injection risk.
The installer treats untrusted request parameters as source-code fragments when constructing a PHP configuration file. Because values are inserted into single-quoted PHP literals without escaping or safe serialization, input can alter the generated program rather than remain data. This is a classic CWE-94 code-injection pattern, compounded by attacker-influenced file placement and an unauthenticated installation workflow. Related interpolation into SQL statements also creates a separate injection risk.
Potential impact
- An attacker may execute arbitrary commands as the web-server user
- Sensitive files accessible to that account may be read
- Files owned by the web-server user could be overwritten or deleted
- Persistent PHP code may be placed in an executable web location
- Stored database connection settings may be controlled or replaced
- Application data may be modified through the secondary SQL-injection sink
- The host or connected services could be used for further compromise
- An attacker may execute arbitrary commands as the web-server user
- Sensitive files accessible to that account may be read
- Files owned by the web-server user could be overwritten or deleted
- Persistent PHP code may be placed in an executable web location
- Stored database connection settings may be controlled or replaced
- Application data may be modified through the secondary SQL-injection sink
- The host or connected services could be used for further compromise
General mitigation guidance
Mitigation generally centers on removing unauthenticated code-generation
behavior and treating installer input strictly as data.
Common defensive patterns include:
- Serialize configuration values with a context-safe serializer rather than concatenating PHP source
- Apply strict allowlists and schema validation before any file or database operation
- Keep installer endpoints disabled, inaccessible, or explicitly authorized after deployment
- Derive output paths from a fixed, trusted application directory and reject traversal or alternate roots
- Use parameterized database queries for all installer-controlled values
- Permit database connections only to approved hosts and require appropriate authentication
- Store generated configuration outside directly served paths where feasible
- Run the web process with least privilege and restrict write access to application directories
- Ensure configuration creation is atomic, auditable, and protected against unauthorized replacement
Mitigation generally centers on removing unauthenticated code-generation
behavior and treating installer input strictly as data.
Common defensive patterns include:
- Serialize configuration values with a context-safe serializer rather than concatenating PHP source
- Apply strict allowlists and schema validation before any file or database operation
- Keep installer endpoints disabled, inaccessible, or explicitly authorized after deployment
- Derive output paths from a fixed, trusted application directory and reject traversal or alternate roots
- Use parameterized database queries for all installer-controlled values
- Permit database connections only to approved hosts and require appropriate authentication
- Store generated configuration outside directly served paths where feasible
- Run the web process with least privilege and restrict write access to application directories
- Ensure configuration creation is atomic, auditable, and protected against unauthorized replacement
How teams detect issues like this
- Use static analysis to identify request data concatenated into PHP source, file paths, or SQL statements
- Review installer code for unauthenticated write operations and dynamically derived filesystem locations
- Monitor web-server logs for requests to installer endpoints, unusual
systemRootPathvalues, and unexpected database hosts - Alert on creation or modification of configuration PHP files outside approved deployment workflows
- Inspect file-integrity and process telemetry for new executable PHP content or commands launched by the web process
- Enforce code-review policies requiring safe serialization, parameterized queries, and authorization around installation functions
- Automated security review tools may help flag source-code generation and injection-prone interpolation patterns
- Use static analysis to identify request data concatenated into PHP source, file paths, or SQL statements
- Review installer code for unauthenticated write operations and dynamically derived filesystem locations
- Monitor web-server logs for requests to installer endpoints, unusual
systemRootPathvalues, and unexpected database hosts - Alert on creation or modification of configuration PHP files outside approved deployment workflows
- Inspect file-integrity and process telemetry for new executable PHP content or commands launched by the web process
- Enforce code-review policies requiring safe serialization, parameterized queries, and authorization around installation functions
- Automated security review tools may help flag source-code generation and injection-prone interpolation patterns
