Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-23489

CVE-2020-23489: AVideo vulnerable to Improper Privilege Management

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-23489
GHSA ID
GHSA-2mgx-226x-8pwv
EPSS Score
0.91048%
CWE
CWE-269
Published
5/24/2022
Updated
2/3/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
wwbn/avideocomposer< 8.98.9

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper validation in objects/import.json.php. The code uses $_POST['fileURI'] to construct a file path and deletes it via unlink($source) if the user has upload privileges. Attackers could exploit this to delete configuration.php, which disables security checks. The patch added a regex check for '.mp4' to prevent arbitrary file paths. The procedural code in this file directly handles the insecure file deletion logic, making it the primary vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** import.json.p*p *il* ***or* *.* *or *Vi**o is vuln*r**l* to * *il* **l*tion vuln*r**ility. T*is *llows t** **l*tion o* *on*i*ur*tion.p*p, **usin* **rt*in privil*** ****ks to not ** in pl***, l***in* to privil*** *s**l*tion to **min. Lo**l *il* In

Reasoning

T** vuln*r**ility st*ms *rom improp*r `v*li**tion` in `o*j**ts/import.json.p*p`. T** *o** us*s `$_POST['*il*URI']` to *onstru*t * *il* p*t* *n* **l*t*s it vi* `unlink($sour**)` i* t** us*r **s uplo** privil***s. *tt**k*rs *oul* *xploit t*is to **l*t*