CyberRota Analysis
AI-GeneratedAVideo's addLiveLink.php script is vulnerable due to inadequate ownership verification, allowing authenticated users to modify LiveLinks belonging to other users. This flaw enables a canStream user to overwrite another user's HLS source and metadata, potentially redirecting viewers to malicious content. Organizations using AVideo should prioritize this vulnerability to prevent unauthorized access and manipulation of media links.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.