CyberRota Analysis
AI-GeneratedThe CustomizeUser plugin in WWBN AVideo is vulnerable to a cross-site request forgery (CSRF) attack, allowing an attacker to exploit an authenticated administrator's session through a crafted GET request. This vulnerability can lead to the unauthorized swapping of the administrator's session with a non-admin user account, temporarily revoking their administrative access, while also exposing sensitive session information. Organizations using AVideo, particularly those with administrative functionalities enabled, should prioritize addressing this issue due to its potential impact on administrative control and session security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.