CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to exploit cross-site request forgery (CSRF) in specific PHP scripts, enabling them to manipulate live transmission history by sending crafted GET requests without proper CSRF token validation. This could lead to unauthorized deletion of live history or marking streams as finished, significantly impacting the integrity of the application. Organizations using WWBN AVideo should prioritize addressing this issue to safeguard against potential exploitation and ensure the security of their streaming services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.