CyberRota Analysis
AI-GeneratedAVideo is vulnerable to a cross-site request forgery and path traversal flaw in the stopLive.php file, which allows attackers to delete directories by exploiting inadequate token validation and unsanitized input. By crafting a malicious image tag with a traversal payload, an attacker can trigger the recursive deletion of the videos directory when an admin accesses the compromised page. Organizations using AVideo should prioritize patching this vulnerability to prevent potential data loss and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.