CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to exploit the _json_decode function in WWBN AVideo, enabling them to perform server-side request forgery (SSRF) by posting file paths or HTTP URLs to login.json.php. This can lead to unauthorized access to local files or internal services, potentially exposing sensitive information such as login credentials. Organizations using AVideo should prioritize patching this vulnerability to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.