Avideo: Malicious plugin RCE

[ahussam]

Hi,
An admin user can upload a zipped file and extract it in the plugin path. However, this can be used to take over the server by uploading a PHP shell. I am just wondering if this is expected behavior?

Thanks!

[akhilleusuggo]

Only admins can , if admin want to burn the server ...

[ahussam]

@akhilleusuggo There is a way that can force him to do that with CSRF.

[akhilleusuggo]

Why an admin would do that ? Would you do that to yourself ?

[ahussam]

@akhilleusuggo https://portswigger.net/web-security/csrf

[ronaldod]

It is always good to look in these things if someone got admin access outside the normal way you can prevent that other code is injected into your server.

[DanielnetoDotCom]

In the configuration.php file, there is a variable called $global['disableAdvancedConfigurations'] = 0;

if you set it = 1 it will disable most of the dangerous features (even for Admins). I must use this on the demo site.