PlayerSkins seo.php 授权缺失漏洞：未认证读取密码保护视频

漏洞概述 漏洞名称： 暴露了密码保护的 VOD URL 和媒体字节 CVE 编号：CVE-2020-XXXX（CVSS 3.1 评分 7.5/10，High） 漏洞类型：授权缺失（Missing Authorization） 根因： 直接可达，未校验 或 ，导致未认证调用者可通过该 URL 读取密码保护的媒体字节。 影响范围 受影响版本： （2026-08-23） 已修复版本：无（No fixed version is available） 影响：未认证攻击者若知道或发现密码保护视频的 numeric ID，即可获取直接媒体 URL 并读取视频内容，绕过正常路径的密码控制，破坏机密性。 修复方案 页面显示 "No fixed version is available"，暂无官方修复版本。 建议缓解措施：在 中增加与正常路径一致的授权检查（ / ），或临时限制该路由的访问。 POC 代码 观察到的输出： ``` {"error":false,"message":"","response":"","msg":"","users_id":1,...} owner status=200 bbb status=200 guest status=200 owner challenge=0 guest challenge=0 owner sources=0 guest sources=0 seo status=200 source=http://localhost:8911/videos/26003212009_yaaa/26003212009_yaaa.mp4 HTTP/1.1 206 Partial Content Content-Type: video/mp4 Content-Range: bytes 0-3/2129 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

PlayerSkins seo.php 授权缺失漏洞：未认证读取密码保护视频

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

PlayerSkins seo.php 授权缺失漏洞：未认证读取密码保护视频

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！