CyberRota Analysis
AI-GeneratedAVideo is vulnerable to a cross-site request forgery (CSRF) flaw in the saveBalance.php file, allowing attackers to manipulate user wallet balances by exploiting session cookies without proper token validation. This vulnerability can be exploited through a crafted webpage, enabling unauthorized changes to wallet balances when an administrator visits the page. Organizations using AVideo should prioritize patching this vulnerability to protect against potential financial manipulation and unauthorized access to user accounts.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.