CVE-2020-23489: 
PHP vulnerability analysis and mitigation

The import.json.php file before version 8.9 for Avideo contained a File Deletion vulnerability that allowed deletion of configuration.php, which led to privilege escalation to admin level access. The vulnerability was discovered and disclosed on November 16, 2020 (AttackerKB).

The vulnerability existed in the import.json.php file where insufficient validation of the fileURI parameter allowed an authenticated user with upload permissions to delete arbitrary files, including the critical configuration.php file. When this configuration file was deleted, certain privilege checks were bypassed, allowing a user to escalate privileges to admin level (Cube01 Blog).

The successful exploitation of this vulnerability allowed an attacker to delete the configuration file, which disabled privilege checks and enabled privilege escalation to administrative access. This gave attackers full control over the application with admin-level permissions (Cube01 Blog).

The vulnerability could be exploited by an authenticated user with upload permissions when the doNotShowImportMP4Button option was disabled. The attack involved sending a specially crafted POST request to the import.json.php endpoint with a manipulated fileURI parameter pointing to the configuration.php file (Cube01 Blog).

The vulnerability was patched in version 8.9 by adding additional validation checks to prevent arbitrary file deletion. A fix was implemented to verify that the fileURI parameter specifically points to an MP4 file using regex pattern matching (GitHub Commit).