CyberRota Analysis
AI-GeneratedAVideo is vulnerable to a cross-site request forgery (CSRF) flaw in the setPassword.json.php endpoint, enabling unauthenticated attackers to change any user's channel password via a crafted GET request. This vulnerability poses a significant risk as it allows attackers to manipulate user accounts without requiring authentication. Organizations using AVideo should prioritize addressing this issue to protect against unauthorized access and potential account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, sets or clears any user's channel password without CSRF token validation.