AVideo Left Full Application Initialization Exposed on the Web

Root Cause

The installer endpoint performed privileged setup operations without authentication, setup tokens, localhost restriction, or any comparable control. Its only guard was whether configuration.php already existed, which is not an access-control mechanism.

Because the attacker could also choose the backing database host and write configuration values to disk, exploitation did not depend on guessing the victim’s database credentials. The design effectively allowed an unauthenticated outsider to become the original administrator of the application.

Weaknesses