CyberRota Analysis
AI-GeneratedThe vulnerability affects the WWBN AVideo platform, specifically in the myLiveControls.save.json.php endpoint, which lacks proper CSRF protection. This allows an attacker to exploit the vulnerability by tricking a logged-in streamer into visiting a malicious page, enabling them to alter viewer-redirect settings to lead users to phishing sites or display deceptive messages. Organizations using AVideo, particularly those with live streaming capabilities, should prioritize addressing this issue to protect their users from potential phishing attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.