CVE-2026-33479: 
PHP vulnerability analysis and mitigation

CVE-2026-33479 is a PHP code injection vulnerability ("PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin") affecting WWBN AVideo versions up to and including 26.0. The Gallery plugin's saveSort.json.php endpoint passes unsanitized user input from $_REQUEST['sections'] array values directly into PHP's eval() function. While the endpoint requires admin authentication, it lacks CSRF token validation; combined with AVideo's explicit SameSite=None session cookie configuration, an unauthenticated attacker can achieve remote code execution by luring an admin to visit a malicious page. It was disclosed on March 20, 2026, with a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): in plugin/Gallery/view/saveSort.json.php lines 20–25, the $value variable from $_REQUEST['sections'] is interpolated directly into a string passed to eval() with no sanitization, allowlist, regex validation, or escaping (GitHub Advisory). The CSRF attack vector is enabled by AVideo's explicit SameSite=None session cookie configuration set in objects/include_config.php when the site runs over HTTPS, which instructs browsers to attach the session cookie on cross-site requests. The endpoint performs no CSRF token validation, no Origin/Referer header check, and no X-Requested-With header check, and there is no global CSRF middleware in AVideo's bootstrap chain. An attacker crafts an auto-submitting HTML form on an attacker-controlled page targeting saveSort.json.php with a malicious PHP payload in the sections parameter; when an authenticated admin visits the page, the browser sends the cross-site POST with the admin's session cookie, User::isAdmin() passes, and the injected PHP executes server-side (GitHub Advisory).

Successful exploitation results in arbitrary PHP code execution on the server under the web server's user context, enabling full server compromise. An attacker can read and write arbitrary files, access and exfiltrate the database, install backdoors, pivot to other internal services, and steal all user data. The attack is stealthy — it completes as a single form submission in milliseconds, and the targeted admin may notice nothing unusual. Any AVideo instance running over HTTPS where an admin can be socially engineered to click a link is within the blast radius (GitHub Advisory, Feedly).

A proof-of-concept exploit (a complete auto-submitting HTML form with a PHP payload) is publicly available in the GitHub security advisory and has been assessed as a real, high-confidence exploit by Feedly threat intelligence (GitHub Advisory). The vulnerability is detectable by Qualys scanner (detection ID 5009465). As of the time of reporting, there is no evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.0014 (0.14%), indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify internet-facing AVideo instances running version ≤ 26.0 over HTTPS using search engines (Shodan, Censys) or by fingerprinting the AVideo web interface.
2. Craft malicious HTML page: Create an HTML page on an attacker-controlled server containing an auto-submitting form targeting https://target/plugin/Gallery/view/saveSort.json.php with a sections[] parameter containing a malicious PHP payload, e.g.:

<form id="exploit" method="POST" action="https://target/plugin/Gallery/view/saveSort.json.php">
  <input type="hidden" name="sections[0]" value="x=1;system(base64_decode('aWQ7aG9zdG5hbWU='));//">
</form>
<script>document.getElementById('exploit').submit();</script>

The base64 value decodes to id;hostname (or any arbitrary command). 3. Social engineering: Lure an authenticated AVideo administrator to visit the attacker-controlled page via a phishing email, comment link, or direct message. 4. CSRF triggers code execution: The admin's browser automatically submits the cross-site POST request with the admin's session cookie attached (due to SameSite=None). The server's User::isAdmin() check passes because the admin's session is present. 5. eval() executes payload: The injected value is passed to eval(), executing: $object->x=1;system(base64_decode('aWQ7aG9zdG5hbWU='));//Order = 0; — breaking out of the property assignment and calling system() with attacker-controlled arguments. 6. Achieve objectives: With arbitrary command execution as the web server user, the attacker can establish a reverse shell, exfiltrate data, install a web shell, or pivot to other services (GitHub Advisory).

• Network: Unexpected cross-origin POST requests to /plugin/Gallery/view/saveSort.json.php from external or unusual referrer origins; outbound connections from the web server to unknown external IPs (reverse shell indicators).
• Logs: Web server access logs showing POST requests to saveSort.json.php with sections[] parameter values containing PHP function names (e.g., system, exec, base64_decode, passthru, shell_exec) or semicolons and comment markers (//); requests with a Referer header pointing to an external/unknown domain.
• File System: Newly created PHP web shell files in the AVideo web root or plugin directories; unexpected files in /tmp or world-writable directories (e.g., output files from executed commands); modified saveSort.json.php or other plugin files.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx process (e.g., /bin/bash, curl, wget, python, nc, ncat); unexpected cron jobs or scheduled tasks added under the web server user account (GitHub Advisory).

The vendor has released a patch in commit 087dab8841f8bdb54be184105ef19b47c5698fcb in the WWBN AVideo GitHub repository; organizations should update to any version after 26.0 that includes this fix (GitHub Advisory). The primary code fix replaces eval() with an allowlist check against known section names (Shorts, Trending, SiteSuggestion, etc.) and uses dynamic property access instead of code generation. As a secondary fix, changing the session cookie SameSite attribute from None to Lax in objects/include_config.php blocks the CSRF vector for all endpoints. For organizations unable to patch immediately: restrict admin access to trusted networks only, monitor for suspicious POST requests to saveSort.json.php, review server and database access logs for unauthorized activity, and educate administrators to avoid clicking untrusted links while logged into the admin panel (Feedly).

The vulnerability received coverage from The Hacker Wire, which published a technical article titled "WWBN AVideo RCE via CSRF and eval" shortly after disclosure (The Hacker Wire). The advisory was also noted on Mastodon and Bluesky by security community accounts. The infinitsec.net blog published a dedicated post analyzing the PHP code injection via eval in Gallery's saveSort.json.php (infinitsec). Community reaction highlighted the particularly dangerous combination of eval() with unsanitized input and SameSite=None cookies as an avoidable design flaw.