CyberRota Analysis
AI-GeneratedAVideo is vulnerable to a cross-site request forgery (CSRF) flaw in the plugin/API/set.json.php file, enabling attackers to execute state-changing actions through crafted GET requests that circumvent CSRF protections. This vulnerability allows unauthorized actions such as deleting videos, deactivating accounts, or modifying playlists without user consent. Organizations using AVideo should prioritize patching this vulnerability to protect their users and data integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.