CyberRota Analysis
AI-GeneratedAVideo versions up to 29.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) due to improper handling of HTTP Host headers in the check_site_availability function. This vulnerability allows attackers to craft requests that can probe internal network resources, potentially leading to unauthorized access or information disclosure. Organizations using AVideo should prioritize patching this vulnerability to mitigate the risk of internal network exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.