WWBN AVideo versions up to 29.0 contain a CSRF vulnerability in the objects/userSavePhoto.php endpoint. This endpoint accepts a base64-encoded POST parameter to update user profile photos but lacks CSRF protections because it is excluded from the global autoCSRFGuard due to its filename suffix. The only access control is verifying the user is logged in. There is no CSRF token, no Origin or Referer header validation, and no MIME type validation of the uploaded data. The platform’s cookie policy allows cross-site requests to carry authentication cookies, enabling an attacker to forge requests that overwrite profile photos and trigger cache clearing. A referenced commit (9c38468041505e637101c5943c5370c68f48e3ac) reportedly contains a fix, but no official patch or advisory is provided in the data.

An attacker can cause a logged-in user to unknowingly overwrite their profile photo with arbitrary data by exploiting the CSRF vulnerability. This can lead to defacement or injection of malicious content in user profiles. Additionally, each forged request triggers a site-wide cache clear, potentially impacting site performance and availability. The vulnerability does not allow direct confidentiality breaches but impacts integrity and availability aspects of the platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description references a commit that contains a fix, indicating a patch may exist. Until official confirmation, users should avoid visiting untrusted sites while logged in to AVideo. Once available, apply the official patch that adds CSRF protections to the affected endpoint. Do not rely on generic mitigations; follow vendor instructions closely.