CyberRota Analysis
AI-GeneratedThe vulnerability exists in the releaseVideoNow.json.php endpoint of WWBN AVideo, which is susceptible to cross-site request forgery due to the absence of authenticity checks and the acceptance of GET requests. This flaw allows attackers to exploit an administrator's session cookie to publish embargoed videos by altering the videos_id parameter, leading to unauthorized content exposure. Organizations using AVideo, particularly those managing sensitive video content, should prioritize addressing this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter.